[ MDVSA-2010:038 ] maildrop

[dude67]

_______________________________________________________________________

Package : maildrop
Date : February 16, 2010
Affected: Corporate 4.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A vulnerability have been discovered and corrected in maildrop:

main.C in maildrop 2.3.0 and earlier, when run by root with the -d
option, uses the gid of root for execution of the .mailfilter file in
a user's home directory, which allows local users to gain privileges
via a crafted file (CVE-2010-0301).

The updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2010-0301
_______________________________________________________________________