Not rated
CVE-2020-3812 qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability
Description
qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories anywhere in the filesystem because qmail-verify runs as root and tests for the existence of files in the attacker's home directory, without dropping its privileges first.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| netqmail | 1.06 | No fix stated |
References
- www.openwall.com www.openwall.com
- bugs.debian.org bugs.debian.org
- www.debian.org www.debian.org
- [debian-lts-announce] 20200604 [SECURITY] [DLA 2234-1] netqmail security update lists.debian.org
- USN-4556-1 usn.ubuntu.com
Timeline
- Published
- Last modified