Security readout for executives and security teams
A flaw in the mailx (Mail) command on older Linux systems let a logged-in user pass an oversized carbon-copy option and take over privileges reserved for the mail group. It is a local privilege escalation from 2000 that required an account on the machine, not remote access. Debian issued a fix at the time, and modern distributions long ago replaced or patched the affected binary. Exposure is limited to unpatched late-1990s and early-2000s Linux distributions (Debian, Slackware 7.0 era) shipping the vulnerable mailx binary with elevated group permissions. Any system patched since 2000 or running a modern distribution is not exposed. Exploitation also requires an existing local shell account on the host. Very low priority for modern environments. This is a 25-year-old local privilege-escalation bug in a mail utility that mainstream Linux vendors patched in 2000. Attention is only warranted if the organization still operates unpatched legacy Linux systems, in which case those systems present broader risk than this single CVE. Mitigation focus: Confirm all Linux hosts run a currently supported distribution with maintained mailx/Mail packages.; Apply vendor updates from Debian or the equivalent upstream advisory for legacy systems still in use.; Remove or restrict setgid bits on legacy mail utilities where the binary is no longer required..
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2000-0545 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.