PT-2004-2889 · Omail · @Mail Webmail

Thijs Dalhuijsen · Published 2004-05-04 · Updated 2017-07-11 · CVE-2004-1993

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions omail webmail version 0.98.5

Description The issue concerns an incomplete patch to the checklogin function in omail.pl, allowing remote attackers to execute arbitrary commands. This can be achieved by using shell metacharacters, such as backticks, in the password variable.

Recommendations For omail webmail version 0.98.5, consider disabling the checklogin function until a complete patch is available. Restrict access to the omail.pl script to minimize the risk of exploitation. Avoid using backticks or other shell metacharacters in the password variable until the issue is resolved.

Fix

Related Identifiers

CVE-2004-1993

Affected Products

@Mail Webmail

References · 5

• http://secunia.com/advisories/9585 · Vendor Advisory
• http://securityfocus.com/bid/10274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1993 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/12948 · Note
• http://marc.info/?l=bugtraq&m=108377215015515&w=2 · Note