PT-2001-2090 · Unknown · Pgpmail.Pl

Published 2001-11-30 · Updated 2016-10-18 · CVE-2001-0937

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PGPMail.pl version 1.31

Description The issue allows remote attackers to execute arbitrary commands. This can be achieved by injecting shell metacharacters into the recipient or pgpuserid parameters.

Recommendations For PGPMail.pl version 1.31, consider restricting or sanitizing input for the recipient and pgpuserid parameters to prevent command injection attacks. As a temporary workaround, restrict access to the script until a patch is available.

Fix

Related Identifiers

CVE-2001-0937

Affected Products

Pgpmail.Pl

References · 3

• http://securityfocus.com/archive/82/243262 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-0937 · Security Note
• http://marc.info/?l=bugtraq&m=100714269114686&w=2 · Note