QmailAdmin Forwarding Rule Lets Remote Users Execute Arbitrary Commands on the System
|
|
SecurityTracker Alert ID: 1007305 |
|
SecurityTracker URL: http://securitytracker.com/id/1007305
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jul 25 2003
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 1.0.13 - 1.0.24
|
Description:
A vulnerability was reported in QmailAdmin. A remote user can execute arbitrary commands on the mail server.
Secunia reported that a remote user can create a "forward rule" to forward e-mail messages to a local system command. The commands are reportedly executed with the privileges of the 'vpopmail' user account. No further details were provided.
|
Impact:
A remote user can execute arbitrary operating system commands with 'vpopmail' user privileges.
|
Solution:
The vendor has released fixed versions (development version 1.0.25, stable version 1.0.6), available at:
http://www.inter7.com/qmailadmin/qmailadmin-1.0.6.tar.gz
http://sourceforge.net/project/showfiles.php?group_id=6691&release_id=173699
|
Vendor URL: www.inter7.com/qmailadmin.html (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
