full-disclosure - [ MDVSA-2010:038 ] maildrop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 16 Feb 2010 21:00:00 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:038 ] maildrop


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:038
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : maildrop
 Date    : February 16, 2010
 Affected: Corporate 4.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability have been discovered and corrected in maildrop:
 
 main.C in maildrop 2.3.0 and earlier, when run by root with the -d
 option, uses the gid of root for execution of the .mailfilter file in
 a user's home directory, which allows local users to gain privileges
 via a crafted file (CVE-2010-0301).
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0301
 _______________________________________________________________________

 Updated Packages:

 Corporate 4.0:
 f6b752753fa1a4e5fb050915672ca251  corporate/4.0/i586/maildrop-1.7.0-9.1.20060mlcs4.i586.rpm
 c30751bbbaa99dbe6bf787280ad1e163  corporate/4.0/i586/maildrop-devel-1.7.0-9.1.20060mlcs4.i586.rpm
 ac29677303ed83a59d852fc202d2b39e  corporate/4.0/i586/maildrop-mysql-1.7.0-9.1.20060mlcs4.i586.rpm
 1d0219502b50788dcfc6cf5651c5c4aa  corporate/4.0/i586/maildrop-openldap-1.7.0-9.1.20060mlcs4.i586.rpm 
 e1862d87d5f4003dbe722f33dc5f0d82  corporate/4.0/SRPMS/maildrop-1.7.0-9.1.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 cdf43f77a101efc865d290e4abd16c08  corporate/4.0/x86_64/maildrop-1.7.0-9.1.20060mlcs4.x86_64.rpm
 373c837656ef6099862e8cd89df7dc69  corporate/4.0/x86_64/maildrop-devel-1.7.0-9.1.20060mlcs4.x86_64.rpm
 d5b96bb02e49413db3aefd660ee34203  corporate/4.0/x86_64/maildrop-mysql-1.7.0-9.1.20060mlcs4.x86_64.rpm
 2c768ab880f838c7c3513ae6f8bcc962  corporate/4.0/x86_64/maildrop-openldap-1.7.0-9.1.20060mlcs4.x86_64.rpm 
 e1862d87d5f4003dbe722f33dc5f0d82  corporate/4.0/SRPMS/maildrop-1.7.0-9.1.20060mlcs4.src.rpm

 Mandriva Enterprise Server 5:
 eee3e4db386d93afc826f636fa4d8f83  mes5/i586/maildrop-1.7.0-14.1mdvmes5.i586.rpm
 f11f173c784f5b13e103412ef1b80fbb  mes5/i586/maildrop-devel-1.7.0-14.1mdvmes5.i586.rpm
 41653a4ef502a213639fef75b731bd94  mes5/i586/maildrop-mysql-1.7.0-14.1mdvmes5.i586.rpm
 58180f1d9d33f553dec2cced968aa60d  mes5/i586/maildrop-openldap-1.7.0-14.1mdvmes5.i586.rpm 
 c17caf47894ecd0d5b435b4ba767e561  mes5/SRPMS/maildrop-1.7.0-14.1mdvmes5.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 dd15808097dda7662345f5e54c597d45  mes5/x86_64/maildrop-1.7.0-14.1mdvmes5.x86_64.rpm
 ebb970d1a70d506119646edc096f8d3c  mes5/x86_64/maildrop-devel-1.7.0-14.1mdvmes5.x86_64.rpm
 44922a84217f505350c3c5e489ec8088  mes5/x86_64/maildrop-mysql-1.7.0-14.1mdvmes5.x86_64.rpm
 15217994457847511ea2ae7291e8c556  mes5/x86_64/maildrop-openldap-1.7.0-14.1mdvmes5.x86_64.rpm 
 c17caf47894ecd0d5b435b4ba767e561  mes5/SRPMS/maildrop-1.7.0-14.1mdvmes5.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLes4TmqjQ0CJFipgRAjrEAJ9oam8bmZsk0DjKC3TvrYclBeKelwCfSoJt
Z4Oy5RxoCppnEo5V7zXM6Ew=
=SMPt
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/