Qmail up to 0.31 AUTH Configuration privileges management

Summaryinfo

A vulnerability categorized as problematic has been discovered in Qmail up to 0.31. Affected by this vulnerability is an unknown functionality of the component AUTH Configuration Handler. Such manipulation leads to privileges management. The attack can be executed remotely. Additionally, an exploit exists. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Qmail up to 0.31 (Mail Server Software) and classified as problematic. Affected by this issue is an unknown functionality of the component AUTH Configuration Handler. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability.

The weakness was released 07/15/2003 by John Simpson as not defined posting (Bugtraq). The advisory is shared for download at securityfocus.com. The attack may be launched remotely. Technical details are unknown but an exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

The exploit is available at securityfocus.com. It is declared as proof-of-concept. As 0-day the estimated underground price was around $25k-$100k.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at jms1.net.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 8196†). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Mail Server Software

Name

• Qmail

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion