PT-2009-4067 · Nasmail+2 · Nasmail+2

Niels Teusink

·

Publicado

2009-05-14

·

Atualizado

2017-09-29

·

CVE-2009-1579

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: SquirrelMail versions prior to 1.4.18 NaSMail versions prior to 1.7
Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. This is due to a problem in the map yp alias function in functions/imap general.php.
Recommendations: For SquirrelMail versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue. For NaSMail versions prior to 1.7, update to version 1.7 or later to resolve the issue. As a temporary workaround, consider restricting the input for the username string to prevent the use of shell metacharacters until a patch is available.

Correção

RCE

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-1579
DSA-1802-1
RHSA-2009:1066
RHSA-2009_1066

Produtos afetados

Nasmail
Red Hat
Squirrelmail