CVE-2004-2303 MTools Mformat before 3.9.9, when installed setuid root, creates files with world-readable and world-writable permissions, which allows local users to read and overwrite files.
LowCVSS 3.6
EPSS 0.63%
- Published
- Updated
- Exploit status
- No public exploit known
Description
MTools Mformat before 3.9.9, when installed setuid root, creates files with world-readable and world-writable permissions, which allows local users to read and overwrite files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mtools mformat | = 3.9.1 | No fix listed |
| mtools mformat | = 3.9.2 | No fix listed |
| mtools mformat | = 3.9.3 | No fix listed |
| mtools mformat | = 3.9.4 | No fix listed |
| mtools mformat | = 3.9.5 | No fix listed |
| mtools mformat | = 3.9.6 | No fix listed |
| mtools mformat | = 3.9.7 | No fix listed |
| mtools mformat | = 3.9.8 | No fix listed |
| mtools mformat | = 3.9.9 | No fix listed |
| debian/mtools(Debian:12) | < 3.9.9 | 3.9.9 |
| debian/mtools(Debian:13) | < 3.9.9 | 3.9.9 |
| debian/mtools(Debian:14) | < 3.9.9 | 3.9.9 |
References
- Debian Security Tracker CVE-2004-2303 vendor-advisory
- MDKSA-2004:016 patch vendor-advisory
- 9746 patch vdb-entry vendor-advisory
- mtools-mformat-insecure-permissions(15317) vdb-entry