CVE-2016-6253

mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbitrary files on the target system via a symlink attack on the user mailbox.

CVSS v3.0 NVD

7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

3.53% chance of exploitation in the next 30 days, 89th percentile

Published

2017-01-20

Updated

2024-08-06

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/138021/NetBSD-mail.local-8-Local-Root.html
• http://www.rapid7.com/db/modules/exploit/unix/local/netbsd_mail_local

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/unix/local/netbsd_mail_local.rb

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/40385
• https://www.exploit-db.com/exploits/40141

Security advisories

• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2016-006.txt.asc
• http://akat1.pl/?id=2
• http://www.securityfocus.com/bid/92101
• http://www.securitytracker.com/id/1036429

References

• CVE Record
• NVD entry