PT-2002-2230 · Heirloom+1 · Mailx+2

Published 2002-11-12 · Updated 2016-10-18 · CVE-2002-1271

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: perl-MailTools package versions 1.47 and earlier

Description: The issue concerns the Mail::Mailer Perl module, which uses mailx as the default mailer. This setup allows remote attackers to execute arbitrary commands by inserting them into the mail body, which is then processed by mailx.

Recommendations: For perl-MailTools package versions 1.47 and earlier, consider updating to a version that does not use mailx as the default mailer or changing the default mailer to one that does not process commands from the mail body. As a temporary workaround, consider restricting the use of the mailx mailer until a patch is available.

Fix

Related Identifiers

CVE-2002-1271

DSA-386

Affected Products

Mail::Mailer

Mailx

Perl-Mailtools

References · 11

• http://linux-mandrake.com/en/security/2002/MDKSA-2002-076.php · Vendor Advisory
• http://debian.org/security/2003/dsa-386 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2002-1271 · Vendor Advisory
• http://iss.net/security_center/static/10548.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1271 · Security Note
• http://novell.com/linux/security/advisories/2002_041_perl_mailtools.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2002-1271 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2002-1271 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=103679569705086&w=2 · Note
• http://securityfocus.com/bid/6104 · Note
• http://marc.info/?l=bugtraq&m=103659723101369&w=2 · Note