CVE-2004-0880: Low severity getmail getmail vulnerability
Published Sep 24, 2004
·Updated
getmail 4.x before 4.2.0, when run as root, allows local users to overwrite arbitrary files via a symlink attack on an mbox file.
Affected Software
27 affected components
getmail getmail=2.3.7
getmail getmail=3.x
getmail getmail=4.0
getmail getmail=4.0.0_b10
getmail getmail=4.0.1
getmail getmail=4.0.2
getmail getmail=4.0.3
getmail getmail=4.0.4
getmail getmail=4.0.5
getmail getmail=4.0.6
getmail getmail=4.0.7
getmail getmail=4.0.8
getmail getmail=4.0.9
getmail getmail=4.0.10
getmail getmail=4.0.11
getmail getmail=4.0.12
getmail getmail=4.0.13
getmail getmail=4.1
getmail getmail=4.1.1
getmail getmail=4.1.2
getmail getmail=4.1.3
getmail getmail=4.1.4
getmail getmail=4.1.5
Gentoo Linux=1.4
Slackware Slackware Linux=9.1
Slackware Slackware Linux=10.0
Slackware Slackware Linux=current
Event History
Sep 24, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0880?
CVE-2004-0880 has been rated as a medium severity vulnerability due to its potential to allow local users to overwrite arbitrary files.
2
How do I fix CVE-2004-0880?
To fix CVE-2004-0880, upgrade to getmail version 4.2.0 or later where this vulnerability is addressed.
3
Which versions of getmail are affected by CVE-2004-0880?
CVE-2004-0880 affects getmail versions 4.x before 4.2.0, including versions such as 4.0.11 and 4.1.*.
4
What type of attack does CVE-2004-0880 involve?
CVE-2004-0880 involves a symlink attack that could be exploited by local users.
5
Can I mitigate CVE-2004-0880 without an update?
Mitigation options without an update are limited, but running getmail as a non-root user can reduce risk.