CVE-2016-6253

HIGH

NetBSD <7.0 - Local Privilege Escalation

Title source: llm

Description

mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbitrary files on the target system via a symlink attack on the user mailbox.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocalnetbsd_x86
https://www.exploit-db.com/exploits/40385
exploitdb WORKING POC VERIFIED
by akat1 · clocalbsd
https://www.exploit-db.com/exploits/40141
metasploit WORKING POC GREAT
by h00die <[email protected]>, akat1 · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/local/netbsd_mail_local.rb

Scores

CVSS v3 7.8
EPSS 0.0727
EPSS Percentile 91.7%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-59
Status published
Products (14)
netbsd/netbsd 6.0
netbsd/netbsd 6.0.1
netbsd/netbsd 6.0.2
netbsd/netbsd 6.0.3
netbsd/netbsd 6.0.4
netbsd/netbsd 6.0.5
netbsd/netbsd 6.0.6
netbsd/netbsd 6.1
netbsd/netbsd 6.1.1
netbsd/netbsd 6.1.2
... and 4 more
Published Jan 20, 2017
Tracked Since Feb 18, 2026