{"modified": "2008-09-05T16:52:20", "id": "CVE-2005-2655", "edition": 1, "objectVersion": "1.2", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-2655", "cvelist": ["CVE-2005-2655"], "references": ["http://www.debian.org/security/2005/dsa-791"], "bulletinFamily": "NVD", "cpe": ["cpe:/a:maildrop:maildrop:1.3.9", "cpe:/a:maildrop:maildrop:1.5.0", "cpe:/a:maildrop:maildrop:0.50", "cpe:/a:maildrop:maildrop:1.2.2", "cpe:/a:maildrop:maildrop:0.70", "cpe:/a:maildrop:maildrop:0.54a", "cpe:/a:maildrop:maildrop:1.4.0", "cpe:/a:maildrop:maildrop:0.99.1", "cpe:/a:maildrop:maildrop:1.3.6", "cpe:/a:maildrop:maildrop:1.3.0", "cpe:/a:maildrop:maildrop:0.99.2", "cpe:/a:maildrop:maildrop:0.55c", "cpe:/a:maildrop:maildrop:1.3.3", "cpe:/a:maildrop:maildrop:0.65", "cpe:/a:maildrop:maildrop:0.74", "cpe:/a:maildrop:maildrop:0.73", "cpe:/a:maildrop:maildrop:0.75", "cpe:/a:maildrop:maildrop:0.72", "cpe:/a:maildrop:maildrop:0.61", "cpe:/a:maildrop:maildrop:0.54", "cpe:/a:maildrop:maildrop:0.71", "cpe:/a:maildrop:maildrop:1.3.1", "cpe:/a:maildrop:maildrop:0.51b", "cpe:/a:maildrop:maildrop:1.3.5", "cpe:/a:maildrop:maildrop:0.55a", "cpe:/a:maildrop:maildrop:1.2", "cpe:/a:maildrop:maildrop:1.3.4", "cpe:/a:maildrop:maildrop:0.55b", "cpe:/a:maildrop:maildrop:0.62", "cpe:/a:maildrop:maildrop:1.1", "cpe:/a:maildrop:maildrop:0.60", "cpe:/a:maildrop:maildrop:1.5.1", "cpe:/a:maildrop:maildrop:0.63", "cpe:/a:maildrop:maildrop:0.54b", "cpe:/a:maildrop:maildrop:0.51c", "cpe:/a:maildrop:maildrop:0.51", "cpe:/a:maildrop:maildrop:0.64", "cpe:/a:maildrop:maildrop:0.76", "cpe:/a:maildrop:maildrop:1.5.2", "cpe:/a:maildrop:maildrop:1.0", "cpe:/a:maildrop:maildrop:1.3.8", "cpe:/a:maildrop:maildrop:1.3.7", "cpe:/a:maildrop:maildrop:0.55", "cpe:/a:maildrop:maildrop:1.2.1"], "title": "CVE-2005-2655", "published": "2005-08-30T13:03:00", "viewCount": 0, "type": "cve", "lastseen": "2016-09-03T05:43:49", "description": "lockmail in maildrop before 1.5.3 does not drop privileges before executing commands, which allows local users to gain privileges via command line arguments.", "hash": "2acc5ead7b137e80570e597c9ae91530eb0cf2125e26555f193cc3cc8c5ad825", "reporter": "NVD", "scanner": [], "assessment": {"system": "", "name": "", "href": ""}, "enchantments": {"vulnersScore": 7.2}}

{"result": {"osvdb": [{"id": "OSVDB:19083", "type": "osvdb", "title": "maildrop lockmail Privileged Local Command Execution", "description": "# No description provided by the source\n\n## References:\nSecurity Tracker: 1014825\n[Secunia Advisory ID:16610](https://secuniaresearch.flexerasoftware.com/advisories/16610/)\nOther Advisory URL: http://www.debian.org/security/2005/dsa-791\n[CVE-2005-2655](https://vulners.com/cve/CVE-2005-2655)\n", "published": "2005-08-30T15:01:15", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://vulners.com/osvdb/OSVDB:19083", "cvelist": ["CVE-2005-2655"], "lastseen": "2017-04-28T13:20:15"}], "openvas": [{"id": "OPENVAS:55193", "type": "openvas", "title": "Debian Security Advisory DSA 791-1 (maildrop)", "description": "The remote host is missing an update to maildrop\nannounced via advisory DSA 791-1.\n\nMax Vozeler discoveredt hat the lockmail program from maildrop, a\nsimple mail delivery agent with filtering abilities, does not drop\ngroup privileges before executing commands given on the commandline,\nallowing an attacker to execute arbitrary commands under with group\nmail privileges.\n\nThe old stable distribution (woody) is not affected by this problem.", "published": "2008-01-17T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=55193", "cvelist": ["CVE-2005-2655"], "lastseen": "2017-07-24T12:50:21"}], "nessus": [{"id": "DEBIAN_DSA-791.NASL", "type": "nessus", "title": "Debian DSA-791-1 : maildrop - missing privilege release", "description": "Max Vozeler discovered that the lockmail program from maildrop, a simple mail delivery agent with filtering abilities, does not drop group privileges before executing commands given on the commandline, allowing an attacker to execute arbitrary commands with privileges of the group mail.", "published": "2005-09-06T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=19561", "cvelist": ["CVE-2005-2655"], "lastseen": "2017-10-29T13:37:35"}], "debian": [{"id": "DSA-791", "type": "debian", "title": "maildrop -- missing privilege release", "description": "Max Vozeler discovered that the lockmail program from maildrop, a simple mail delivery agent with filtering abilities, does not drop group privileges before executing commands given on the commandline, allowing an attacker to execute arbitrary commands with privileges of the group mail.\n\nThe old stable distribution (woody) is not affected by this problem.\n\nFor the stable distribution (sarge) this problem has been fixed in version 1.5.3-1.1sarge1.\n\nFor the unstable distribution (sid) this problem has been fixed in version 1.5.3-2.\n\nWe recommend that you upgrade your maildrop package.", "published": "2005-08-30T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://www.debian.org/security/dsa-791", "cvelist": ["CVE-2005-2655"], "lastseen": "2016-09-02T18:29:54"}]}}