PT-2002-2230 · Heirloom+1 · Mailx+2

Publicado 2002-11-12 · Atualizado 2016-10-18 · CVE-2002-1271

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: perl-MailTools package versions 1.47 and earlier

Description: The issue concerns the Mail::Mailer Perl module, which uses mailx as the default mailer. This setup allows remote attackers to execute arbitrary commands by inserting them into the mail body, which is then processed by mailx.

Recommendations: For perl-MailTools package versions 1.47 and earlier, consider updating to a version that does not use mailx as the default mailer or changing the default mailer to one that does not process commands from the mail body. As a temporary workaround, consider restricting the use of the mailx mailer until a patch is available.

Correção

Identificadores relacionados

CVE-2002-1271

DSA-386

Produtos afetados

Mail::Mailer

Mailx

Perl-Mailtools

Referências · 11

• http://marc.info/?l=bugtraq&m=103679569705086&w=2 · Nota
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-076.php · Aviso do Fabricante
• http://debian.org/security/2003/dsa-386 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2002-1271 · Aviso do Fabricante
• http://securityfocus.com/bid/6104 · Nota
• http://iss.net/security_center/static/10548.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-1271 · Nota de Segurança
• http://novell.com/linux/security/advisories/2002_041_perl_mailtools.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2002-1271 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=103659723101369&w=2 · Nota
• https://security-tracker.debian.org/tracker/CVE-2002-1271 · Aviso do Fabricante