Vulnerability Name:

CVE-2006-5297 (CCN-29638)

Assigned:2006-10-04
Published:2006-10-04
Updated:2017-10-11
Summary:Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.
CVSS v3 Severity:4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:1.2 Low (CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:N)
0.9 Low (Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)
1.6 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-Other
Vulnerability Consequences:File Manipulation
References:Source: MITRE
Type: CNA
CVE-2006-5297

Source: MLIST
Type: UNKNOWN
[mutt-dev] 20061004 security problem with temp files [was Re: mutt_adv_mktemp() ?]

Source: CCN
Type: BugTraq Mailing List, 2006-10-04 20:39:29
security problem with temp files [was Re: mutt_adv_mktemp() ?]

Source: CCN
Type: RHSA-2007-0386
Moderate: mutt security update

Source: CCN
Type: SA22613
Mutt Insecure Temporary File Creation Weaknesses

Source: SECUNIA
Type: UNKNOWN
22613

Source: SECUNIA
Type: UNKNOWN
22640

Source: SECUNIA
Type: UNKNOWN
22685

Source: SECUNIA
Type: UNKNOWN
22686

Source: SECUNIA
Type: UNKNOWN
25529

Source: CCN
Type: ASA-2007-296
Mutt security update (RHSA-2007-0386)

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:190

Source: CCN
Type: Mutt Web site
The Mutt E-Mail Client

Source: REDHAT
Type: UNKNOWN
RHSA-2007:0386

Source: BID
Type: UNKNOWN
20733

Source: CCN
Type: BID-20733
Mutt Insecure Temporary File Creation Multiple Vulnerabilities

Source: TRUSTIX
Type: UNKNOWN
2006-0061

Source: CCN
Type: USN-373-1
mutt vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-373-1

Source: VUPEN
Type: UNKNOWN
ADV-2006-4176

Source: XF
Type: UNKNOWN
mutt-safeopen-race-condition(29638)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10601

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mutt:mutt:0.95.6:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.2.5:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.2.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.2.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.2.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.2.5.12:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.2.5.12_ol:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.3.12:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.3.12.1:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.3.16:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.3.17:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.3.22:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.3.24:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.3.25:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.3.27:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.3.28:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.4.0:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.4.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:1.5.10:*:*:*:*:*:*:*
  • OR cpe:/a:mutt:mutt:*:*:*:*:*:*:*:* (Version <= 1.5.12)

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:22532
    P
    		ELSA-2007:0386: mutt security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:10601
    V
    		Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.
    2013-04-29
    oval:com.redhat.rhsa:def:20070386
    P
    		RHSA-2007:0386: mutt security update (Moderate)
    2008-03-20
    BACK
    mutt mutt 0.95.6
    mutt mutt 1.2.1
    mutt mutt 1.2.5
    mutt mutt 1.2.5.1
    mutt mutt 1.2.5.4
    mutt mutt 1.2.5.5
    mutt mutt 1.2.5.12
    mutt mutt 1.2.5.12_ol
    mutt mutt 1.3.12
    mutt mutt 1.3.12.1
    mutt mutt 1.3.16
    mutt mutt 1.3.17
    mutt mutt 1.3.22
    mutt mutt 1.3.24
    mutt mutt 1.3.25
    mutt mutt 1.3.27
    mutt mutt 1.3.28
    mutt mutt 1.4.0
    mutt mutt 1.4.1
    mutt mutt 1.4.2
    mutt mutt 1.4.2.1
    mutt mutt 1.5.3
    mutt mutt 1.5.10
    mutt mutt *