PT-2020-3627 · Qmail+2 · Netqmail+2

Georgi Guninski · Published 2020-05-24 · Updated 2022-04-28 · CVE-2020-3812

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions netqmail version 1.06

Description The issue is related to the qmail-verify module in the netqmail email client, which lacks protection for service data. This can allow an attacker to gain access to confidential data. A local attacker can test for the existence of files and directories anywhere in the filesystem because qmail-verify runs as root and tests for the existence of files in the attacker's home directory, without dropping its privileges first.

Recommendations For netqmail version 1.06, consider restricting the privileges of the qmail-verify module to prevent it from running as root, or apply configuration changes to limit its access to sensitive files and directories. As a temporary workaround, consider disabling the qmail-verify module until a patch is available.

Exploit

Fix

Improper Privilege Management

Information Disclosure

Weakness Enumeration

CWE-269

CWE-200

Related Identifiers

BDU:2020-03974

CVE-2020-3812

DLA-2234-1

DSA-4692-1

USN-4556-1

USN-4621-1

Affected Products

Linuxmint

Ubuntu

Netqmail

References · 24

• 🔥 https://openwall.com/lists/oss-security/2020/05/19/8 · Exploit
• https://ubuntu.com/security/CVE-2020-3811 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2234-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3812 · Security Note
• https://ubuntu.com/security/CVE-2020-3812 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-3812 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-3812 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3812 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03974 · Security Note
• https://osv.dev/vulnerability/DSA-4692-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4621-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4556-1 · Vendor Advisory
• https://usn.ubuntu.com/4556-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4556-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4621-1 · Vendor Advisory