OMail Webmail Remote Command Execution Variant Vulnerability

Bugtraq ID:	10274
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 04 2004 12:00AM
Updated:	May 04 2004 12:00AM
Credit:	The disclosure of this vulnerability has been credited to Thijs Dalhuijsen <[email protected]>.
Vulnerable:	OMail OMail webmail 0.98.5 OMail OMail webmail 0.98.3 OMail OMail webmail 0.97.3
Not Vulnerable:

OMail Webmail Remote Command Execution Variant Vulnerability

A vulnerability has been reported in OMail that allows a remote attacker to execute arbitrary commands on a vulnerable host. The problem is due to insufficient sanitization of shell metacharacters that are passed to the vulnerable software through URI parameters.

Exploitation of the vulnerability could allow a non-privileged user to remotely execute arbitrary commands in the context of the web server that is hosting the vulnerable application.

OMail Webmail Remote Command Execution Variant Vulnerability

There is no exploit required.

OMail Webmail Remote Command Execution Variant Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

OMail Webmail Remote Command Execution Variant Vulnerability

References:

• OMail webmail (OMail)
  
• remote root exec vulnerability in omail (Thijs Dalhuijsen )