CVE-2013-4223
Gentoo Nullmailer - Unprotected Credentials Exposure via World-Readable Configuration File
Title source: llmDescription
The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain SMTP authentication credentials by reading the file.
References (6)
Core 6
Core References
Mailing List mailing-list
x_refsource_mlist
http://seclists.org/oss-sec/2013/q3/337
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/86384
Mailing List mailing-list
x_refsource_mlist
http://seclists.org/oss-sec/2013/q3/339
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/61743
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/96177
Issue Tracking x_refsource_confirm
https://bugs.gentoo.org/show_bug.cgi?id=480376
Scores
EPSS
0.0043
EPSS Percentile
62.9%
Details
CWE
CWE-264
Status
published
Products (1)
gentoo/nullmailer
1.11
Published
May 23, 2014
Tracked Since
Feb 18, 2026