OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4875-1 advisory.

    It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under     certain conditions. An attacker could possibly use this vulnerability to execute arbitrary commands as     root. (CVE-2020-7247)

    It was discovered that OpenSMTPD did not properly handle hardlinks under certain conditions. An     unprivileged local attacker could possibly use this issue to obtain sensitive information. This issue only     affected Ubuntu 16.04 ESM. (CVE-2020-8793)

    It was discovered that OpenSMTPD mishandled certain input. A remote, unauthenticated attacker could     possibly use this vulnerability to execute arbitrary shell commands as any non-root user. This issue only     affected Ubuntu 16.04 ESM. (CVE-2020-8794)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4294-1 advisory.

    It was discovered that OpenSMTPD mishandled certain input. A remote, unauthenticated attacker could use     this vulnerability to execute arbitrary shell commands as any non-root user. (CVE-2020-8794)

    It was discovered that OpenSMTPD did not properly handle hardlinks under certain conditions. An     unprivileged local attacker could read the first line of any file on the filesystem. (CVE-2020-8793)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

OpenSMTPD developers reports :

An out of bounds read in smtpd allows an attacker to inject arbitrary commands into the envelope file which are then executed as root.
Separately, missing privilege revocation in smtpctl allows arbitrary commands to be run with the _smtpq group.

An unprivileged local attacker can read the first line of an arbitrary file (for example, root's password hash in /etc/master.passwd) or the entire contents of another user's file (if this file and /var/spool/smtpd/ are on the same filesystem).

Qualys reports :

We discovered a minor vulnerability in OpenSMTPD, OpenBSD's mail server : an unprivileged local attacker can read the first line of an arbitrary file (for example, root's password hash in /etc/master.passwd) or the entire contents of another user's file (if this file and /var/spool/smtpd/ are on the same filesystem).

ID	Name	Product	Family	Severity
183572	Ubuntu 16.04 ESM : OpenSMTPD vulnerabilities (USN-4875-1)	Nessus	Ubuntu Local Security Checks	critical
134299	Ubuntu 18.04 LTS : OpenSMTPD vulnerabilities (USN-4294-1)	Nessus	Ubuntu Local Security Checks	critical
133973	FreeBSD : OpenSMTPd -- LPE and RCE in OpenSMTPD's default install (f0683976-5779-11ea-8a77-1c872ccb1e42)	Nessus	FreeBSD Local Security Checks	critical
133971	FreeBSD : OpenSMTPd -- Local information disclosure (76f1ce19-5749-11ea-bff8-c85b76ce9b5a)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2020-8793

medium

Tenable Plugins

critical

critical

critical

medium