Skip to content
OpenAdvisories
Unscored CVE-2017-14102 EUVD-2017-5614GHSA-4r96-mm68-cwx7

MIMEDefang 2.80 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbit…

Published Sep 1, 2017 · Updated Sep 17, 2024 · Assigned by mitre

Description

MIMEDefang 2.80 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by the init-script.in and mimedefang-init.in scripts.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 mimedefang 2.83-1 —
Debian 13 mimedefang 2.83-1 —
Debian 12 mimedefang 2.83-1 —
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS mimedefang No fix yet —

References