PT-2004-1921 · Getmail · Getmail

David Watson · Published 2004-09-24 · Updated 2017-07-11 · CVE-2004-0880

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Low

Base vector

AV:L/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: getmail versions 4.0 through 4.2.0

Description: The issue allows local users to overwrite arbitrary files via a symlink attack on an mbox file when getmail is run as root.

Recommendations: For getmail versions 4.0 through 4.1.x, update to version 4.2.0 or later to resolve the issue. For getmail version 4.2.0 before the fix, update to the fixed version to resolve the issue.

Fix

Related Identifiers

CVE-2004-0880

DSA-553-1

Affected Products

Getmail

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2004-0880 · Security Note
• http://debian.org/security/2004/dsa-553 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200409-32.xml · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17437 · Note
• http://qcc.ca/~charlesc/software/getmail-4/CHANGELOG · Note
• http://marc.info/?l=bugtraq&m=109571883130372&w=2 · Note