Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.

From Red Hat Security Advisory 2007:0386 :

An updated mutt package that fixes several security bugs is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mutt is a text-mode mail user agent.

A flaw was found in the way Mutt used temporary files on NFS file systems. Due to an implementation issue in the NFS protocol, Mutt was not able to exclusively open a new file. A local attacker could conduct a time-dependent attack and possibly gain access to e-mail attachments opened by a victim. (CVE-2006-5297)

A flaw was found in the way Mutt processed certain APOP authentication requests. By sending certain responses when mutt attempted to authenticate against an APOP server, a remote attacker could potentially acquire certain portions of a user's authentication credentials. (CVE-2007-1558)

A flaw was found in the way Mutt handled certain characters in gecos fields which could lead to a buffer overflow. The gecos field is an entry in the password database typically used to record general information about the user. A local attacker could give themselves a carefully crafted 'Real Name' which could execute arbitrary code if a victim uses Mutt and expands the attackers alias. (CVE-2007-2683)

All users of mutt should upgrade to this updated package, which contains a backported patches to correct these issues.

A flaw was found in the way Mutt used temporary files on NFS file systems. Due to an implementation issue in the NFS protocol, Mutt was not able to exclusively open a new file. A local attacker could conduct a time-dependent attack and possibly gain access to e-mail attachments opened by a victim. (CVE-2006-5297)

A flaw was found in the way Mutt processed certain APOP authentication requests. By sending certain responses when mutt attempted to authenticate against an APOP server, a remote attacker could potentially acquire certain portions of a user's authentication credentials. (CVE-2007-1558)

A flaw was found in the way Mutt handled certain characters in gecos fields which could lead to a buffer overflow. The gecos field is an entry in the password database typically used to record general information about the user. A local attacker could give themselves a carefully crafted 'Real Name' which could execute arbitrary code if a victim uses Mutt and expands the attackers alias. (CVE-2007-2683)

Race conditions were discovered in mutt's handling of temporary files.
Under certain conditions when using a shared temp directory (the default), other local users could overwrite arbitrary files owned by the user running mutt. This vulnerability is more likely when the temp directory is over NFS.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated mutt package that fixes several security bugs is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mutt is a text-mode mail user agent.

A flaw was found in the way Mutt used temporary files on NFS file systems. Due to an implementation issue in the NFS protocol, Mutt was not able to exclusively open a new file. A local attacker could conduct a time-dependent attack and possibly gain access to e-mail attachments opened by a victim. (CVE-2006-5297)

A flaw was found in the way Mutt processed certain APOP authentication requests. By sending certain responses when mutt attempted to authenticate against an APOP server, a remote attacker could potentially acquire certain portions of a user's authentication credentials. (CVE-2007-1558)

A flaw was found in the way Mutt handled certain characters in gecos fields which could lead to a buffer overflow. The gecos field is an entry in the password database typically used to record general information about the user. A local attacker could give themselves a carefully crafted 'Real Name' which could execute arbitrary code if a victim uses Mutt and expands the attackers alias. (CVE-2007-2683)

All users of mutt should upgrade to this updated package, which contains a backported patches to correct these issues.

A race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.
(CVE-2006-5297)

The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safe_fopen function calls. (CVE-2006-5298)

Updated packages have been patched to correct these issues.

ID	Name	Product	Family	Severity
67505	Oracle Linux 3 / 4 / 5 : mutt (ELSA-2007-0386)	Nessus	Oracle Linux Local Security Checks	low
60195	Scientific Linux Security Update : mutt on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	low
27954	Ubuntu 5.10 / 6.06 LTS / 6.10 : mutt vulnerabilities (USN-373-1)	Nessus	Ubuntu Local Security Checks	low
25404	RHEL 3 / 4 / 5 : mutt (RHSA-2007:0386)	Nessus	Red Hat Local Security Checks	low
25403	CentOS 3 / 4 / 5 : mutt (CESA-2007:0386)	Nessus	CentOS Local Security Checks	low
24575	Mandrake Linux Security Advisory : mutt (MDKSA-2006:190)	Nessus	Mandriva Local Security Checks	low

Detections

Analytics

CVE-2006-5297

critical

Tenable Plugins

low

low

low

low

low

low