CVE		CVE-2010-0301
Status		Candidate
Description		main.C in maildrop 2.3.0 and earlier, when run by root with the -d option, uses the gid of root for execution of the .mailfilter file in a user's home directory, which allows local users to gain privileges via a crafted file.
Severity		Medium
CVSS score		6,9
CVSS vector		(AV:L/AC:M/Au:N/C:C/I:C/A:C)
Phase		Assigned (06.01.2011)
NVD:		http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0301
References		CONFIRM : http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=5...
		CONFIRM : http://www.courier-mta.org/maildrop/changelog.html
		CONFIRM : https://bugzilla.redhat.com/show_bug.cgi?id=559681
		DEBIAN : DSA-1981
		MLIST : [oss-security] 20100127 CVE id request: maildrop
		MLIST : [oss-security] 20100128 Re: CVE id request: maildrop
		MLIST : [oss-security] 20100128 Re: CVE id request: maildrop
		MLIST : [oss-security] 20100128 Re: CVE id request: maildrop
		SECTRACK : 1023515
		SECUNIA : 38367
		SECUNIA : 38374
		XF : maildrop-group-priv-escalation(55980)
SecurityVulns:		maildrop privilege escalation