OSVDB ID: 16811 Title: Qpopper Unspecified Privileged File Creation |
Info |
|
|
Dates |
||||
|
|
Description |
Qpopper contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when Qpopper fails to set a proper umask for its process, causing it to create unspecified group- and world-writable files which could contribute to further attacks including privilege escalation. |
Classification |
Location:
Local Access Required
Attack Type: Input Manipulation, Misconfiguration, Race Condition Impact: Loss of Confidentiality Exploit: Exploit Rumored / Private Disclosure: OSVDB Verified |
Solution |
Upgrade to version 4.08 or higher, as it has been reported to fix this vulnerability. In addition, Gentoo and Debian have released patches for some older versions. |
Products |
|
References |
|
Credit |
Unknown or Incomplete |