[ GLSA 202006-12 ] GNU Mailutils

[GLSA]

Gentoo Linux Security Advisory

Title: GNU Mailutils: Privilege escalation (GLSA 202006-12)
Severity: high
Exploitable: local
Date: 2020-06-13
Bug(s): #700806
ID: 202006-12

Synopsis

A vulnerability has been found in GNU Mailutils allowing privilege
escalation.


Background

The GNU Mailutils are a collection of mail-related utilities, including
an IMAP4 server (imap4d).


Affected Packages

Package: net-mail/mailutils
Vulnerable: < 3.8
Unaffected: >= 3.8
Architectures: All supported architectures


Description

GNU Mailutils runs maidag by default with setuid root permissions.

Impact

An attacker can use this to write to arbitrary files as root.

Workaround

There is no known workaround at this time.

Resolution

All GNU Mailutils users should upgrade to the latest version: