vulnwire
7.0high

CVE-2017-58991 exploit

Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows local users to write to…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.0
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 62%
Public exploits
1
Exploit-DB

Directory traversal vulnerability in the setuid root helper binary in S-nail (later S-mailx) before 14.8.16 allows local users to write to arbitrary files and consequently gain root privileges via a .. (dot dot) in the randstr argument.

Exploit prediction (EPSS)

0.98% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.

Exploits and detections

  • EDB-47172 S-nail < 14.8.16 - Local Privilege Escalation · local · 2019-01-13

CVSS scores

Assigned byVersionScoreVector
NVD3.07.0CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.06.9AV:L/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

  • openwall.com /lists/oss-security/2017/02/07/4 · mailing-list, x_refsource_MLIST, x_transferred
  • mail-archive.com /s-nail-users%40lists.sourceforge.net/msg00551.html · mailing-list, x_refsource_MLIST, x_transferred
  • openwall.com /lists/oss-security/2017/01/27/7 · mailing-list, x_refsource_MLIST, x_transferred
  • securityfocus.com /bid/96138 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.