PT-2004-2889 · Omail · @Mail Webmail

Thijs Dalhuijsen · Publicado 2004-05-04 · Atualizado 2017-07-11 · CVE-2004-1993

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions omail webmail version 0.98.5

Description The issue concerns an incomplete patch to the checklogin function in omail.pl, allowing remote attackers to execute arbitrary commands. This can be achieved by using shell metacharacters, such as backticks, in the password variable.

Recommendations For omail webmail version 0.98.5, consider disabling the checklogin function until a complete patch is available. Restrict access to the omail.pl script to minimize the risk of exploitation. Avoid using backticks or other shell metacharacters in the password variable until the issue is resolved.

Correção

Identificadores relacionados

CVE-2004-1993

Produtos afetados

@Mail Webmail

Referências · 5

• http://secunia.com/advisories/9585 · Aviso do Fabricante
• http://securityfocus.com/bid/10274 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/12948 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1993 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=108377215015515&w=2 · Nota