CVE-2003-0308 The Sendmail 8.12.3 package in Debian GNU/Linux 3.0 does not securely create temporary files, which could allow local users to gain additional privileges via (1) expn, (2) checksendmail, or (3) double...
HighCVSS 7.2
EPSS 0.40%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Sendmail 8.12.3 package in Debian GNU/Linux 3.0 does not securely create temporary files, which could allow local users to gain additional privileges via (1) expn, (2) checksendmail, or (3) doublebounce.pl.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/sendmail(Debian:12) | < 8.12.9-2 | 8.12.9-2 |
| debian/sendmail(Debian:13) | < 8.12.9-2 | 8.12.9-2 |
| debian/sendmail(Debian:14) | < 8.12.9-2 | 8.12.9-2 |
| sendmail | = 8.9.3 | No fix listed |
| sendmail | = 8.12.3 | No fix listed |
| sendmail | = 8.12.9 | No fix listed |
| debian linux | = 3.0 | No fix listed |
References
- Debian Security Tracker CVE-2003-0308 vendor-advisory
- bugs.debian.org
- dev.gentoo.org
- DSA-305 patch vendor-advisory
- [oss-security] 20081030 CVE requests: tempfile issues for aview, mgetty, openoffice, crossfire mailing-list
- bugs.gentoo.org