Description
The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain SMTP authentication credentials by reading the file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nullmailer | 1:1.11-2 | — |
| Debian 13 | nullmailer | 1:1.11-2 | — |
| Debian 12 | nullmailer | 1:1.11-2 | — |
References
- [oss-security] 20130809 Re: CVE request: nullmailer world readable /etc/nullmailer/remotes mailing-list
- nullmailer-cve20134223-insecure-permissions(86384) vdb-entry
- [oss-security] 20130809 Re: CVE request: nullmailer world readable /etc/nullmailer/remotes mailing-list
- 61743 vdb-entry
- 96177 vdb-entry
- https://bugs.gentoo.org/show_bug.cgi?id=480376