Race condition in mail.local in NetBSD - CVE-2016-6253

Vulnerability identifier: #VU196

CSH Severity: High

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6253

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to obtain root privileges on the target system.

The vulnerability exists due to an access control error in NetBSD. A local user can exploit the race condition in mail.local(8) to change the ownership of arbitrary files or append arbitrary data to arbitrary files to gain root privileges on the target system.

Successful exploitation of this vulnerability may result in root access via local system.

NetBSD

Solution for this vulnerability is avaliable at:

http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-006.txt.asc

• Exploit #369 - NetBSD mail.local(8) - Privilege Escalation (NetBSD-SA2016-006) (March 18, 2020)
• Exploit #370 - NetBSD mail.local(8) - Privilege Escalation (Metasploit) (March 18, 2020)
• Exploit #1738 - NetBSD mail.local Privilege Escalation (March 18, 2020)

• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-006.txt.asc

• Race condition in mail.local in NetBSD