PT-2020-1569 · Openbsd+1 · Opensmtpd+1

Published 2020-01-29 · Updated 2025-11-07 · CVE-2020-7247

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSMTPD versions 6.6

Description The issue is related to the smtp mailaddr function in the smtp session.c file of the OpenSMTPD mail daemon, which is used in OpenBSD and other products. It allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

Recommendations For OpenSMTPD version 6.6, update to version 6.6.2 to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable smtp mailaddr function in the smtp session.c file until a patch is available. Avoid using the MAIL FROM field with shell metacharacters in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

Improper Handling of Exceptional Conditions

Unchecked Return Value

OS Command Injection

Weakness Enumeration

CWE-755

CWE-252

CWE-78

Related Identifiers

BDU:2020-00579

CVE-2020-7247

DSA-4611-1

USN-4268-1

USN-4875-1

Affected Products

Opensmtpd

Ubuntu

References · 65

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/local/opensmtpd_oob_read_lpe.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/smtp/opensmtpd_mail_from_rce.rb · Exploit
• 🔥 https://github.com/FiroSolutions/cve-2020-7247-exploit · Exploit
• 🔥 https://github.com/QTranspose/CVE-2020-7247-exploit · Exploit
• 🔥 https://github.com/superzerosec/cve-2020-7247 · Exploit
• 🔥 https://github.com/r0lh/CVE-2020-7247 · Exploit
• 🔥 https://packetstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/48051 · Exploit
• 🔥 https://exploit-db.com/exploits/48038 · Exploit
• 🔥 http://packetstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-Escalation-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/156145/OpenSMTPD-6.6.2-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/47984 · Exploit
• 🔥 http://packetstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-Execution.html · Exploit
• 🔥 http://openwall.com/lists/oss-security/2020/01/28/3 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2020/Jan/49 · Exploit