Executive brief
A security vulnerability exists in the 'deliver' mail program used in Linux environments. This flaw allows a local user to bypass security restrictions and gain full administrative (root) control over the system. Such an exploit could lead to complete data loss, unauthorized access to sensitive information, and total system compromise.
Technical details
The 'deliver' mail program contains a buffer overflow vulnerability. By providing specially crafted input to the utility, a local attacker can trigger the overflow to execute arbitrary code with elevated privileges. Because the program typically runs with high privileges to handle mail delivery, successful exploitation allows a standard user to gain root access. This is a classic stack-based or heap-based overflow resulting from insufficient bounds checking on user-supplied data.
Affected products
- Linux deliver
Timeline
- 1998-01-01: disclosed