maildrop Group Permission Dropping Privilege Escalation Vulnerability

Bugtraq ID:	37984
Class:	Design Error
CVE:	CVE-2010-0301
Remote:	No
Local:	Yes
Published:	Jan 28 2010 12:00AM
Updated:	Sep 06 2010 08:52PM
Credit:	Christoph Anton Mitterer
Vulnerable:	Red Hat Fedora 12 Red Hat Fedora 11 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 maildrop maildrop 2.3 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	maildrop maildrop 2.4 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1

maildrop Group Permission Dropping Privilege Escalation Vulnerability

The 'maildrop' program is prone to a privilege-escalation vulnerability.

Local attackers may exploit this issue to obtain elevated privileges and compromise a computer.

Versions prior to maildrop 2.4 are vulnerable.

maildrop Group Permission Dropping Privilege Escalation Vulnerability

Attackers can use readily available tools to exploit this issue.

maildrop Group Permission Dropping Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for details.


Debian Linux 4.0 arm

• Debian maildrop_2.0.2-11+etch1_arm.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.2 -11+etch1_arm.deb

Debian Linux 5.0 ia-64

• Debian maildrop_2.0.4-3+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.4 -3+lenny1_ia64.deb

Debian Linux 4.0 powerpc

• Debian maildrop_2.0.2-11+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.2 -11+etch1_powerpc.deb

Debian Linux 5.0 alpha

• Debian maildrop_2.0.4-3+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.4 -3+lenny1_alpha.deb

Debian Linux 5.0 ia-32

• Debian maildrop_2.0.4-3+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.4 -3+lenny1_i386.deb

Debian Linux 5.0 s/390

• Debian maildrop_2.0.4-3+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.4 -3+lenny1_s390.deb

Debian Linux 5.0 mipsel

• Debian maildrop_2.0.4-3+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.4 -3+lenny1_mipsel.deb

Debian Linux 4.0 amd64

• Debian maildrop_2.0.2-11+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.2 -11+etch1_amd64.deb

Debian Linux 4.0 ia-32

• Debian maildrop_2.0.2-11+etch1_i386.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.2 -11+etch1_i386.deb

Debian Linux 5.0 hppa

• Debian maildrop_2.0.4-3+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.4 -3+lenny1_hppa.deb

Debian Linux 4.0 hppa

• Debian maildrop_2.0.2-11+etch1_hppa.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.2 -11+etch1_hppa.deb

Debian Linux 4.0 s/390

• Debian maildrop_2.0.2-11+etch1_s390.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.2 -11+etch1_s390.deb

Debian Linux 5.0 arm

• Debian maildrop_2.0.4-3+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.4 -3+lenny1_arm.deb

maildrop maildrop 2.3

• maildrop maildrop-2.4.0.tar.bz2
  http://sourceforge.net/projects/courier/files/maildrop/2.4.0/maildrop- 2.4.0.tar.bz2

Debian Linux 4.0 alpha

• Debian maildrop_2.0.2-11+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.2 -11+etch1_alpha.deb

Debian Linux 5.0 armel

• Debian maildrop_2.0.4-3+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.4 -3+lenny1_armel.deb

Debian Linux 5.0 amd64

• Debian maildrop_2.0.4-3+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.4 -3+lenny1_amd64.deb

Debian Linux 4.0 mipsel

• Debian maildrop_2.0.2-11+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.2 -11+etch1_mipsel.deb

Debian Linux 5.0 mips

• Debian maildrop_2.0.4-3+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.4 -3+lenny1_mips.deb

Debian Linux 5.0 powerpc

• Debian maildrop_2.0.4-3+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.4 -3+lenny1_powerpc.deb

Debian Linux 4.0 ia-64

• Debian maildrop_2.0.2-11+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/m/maildrop/maildrop_2.0.2 -11+etch1_ia64.deb

maildrop Group Permission Dropping Privilege Escalation Vulnerability

References:

• #564601 - possible problems when switching UID/GIDs in delivery mode when run as (Christoph Anton Mitterer)
  
• Bug 559681 �?? CVE-2010-0301 maildrop: does not drop supplimentary groups when dro (Vincent Danen)
  
• maildrop Changelog (maildrop)
  
• maildrop Homepage (Double Precision)