PT-2009-4067 · Nasmail+2 · Nasmail+2
Niels Teusink
·
Published
2009-05-14
·
Updated
2017-09-29
·
CVE-2009-1579
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
SquirrelMail versions prior to 1.4.18
NaSMail versions prior to 1.7
Description:
The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a
username string that is used by the ypmatch program. This is due to a problem in the map yp alias function in functions/imap general.php.Recommendations:
For SquirrelMail versions prior to 1.4.18, update to version 1.4.18 or later to resolve the issue.
For NaSMail versions prior to 1.7, update to version 1.7 or later to resolve the issue.
As a temporary workaround, consider restricting the input for the
username string to prevent the use of shell metacharacters until a patch is available.Fix
RCE
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nasmail
Red Hat
Squirrelmail