nph-maillist Arbitrary Code Execution Vulnerability

Bugtraq ID:	2563
Class:	Input Validation Error
CVE:	CVE-2001-0400
Remote:	Yes
Local:	No
Published:	Apr 10 2001 12:00AM
Updated:	Jul 11 2009 06:06AM
Credit:	Posted to bugtraq on April 10, 2001 by Kanedaaa Bohater <[email protected]>.
Vulnerable:	Matt Tourtillott nph-maillist 3.5 Matt Tourtillott nph-maillist 3.0
Not Vulnerable:

nph-maillist Arbitrary Code Execution Vulnerability

nph-maillist is a Perl CGI script that handles mailing lists, typically used to notify interested users of site updates. A hostile user can enter commands embedded in an email address via the subscription form, and then force a mailing which will execute the commands.

nph-maillist Arbitrary Code Execution Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

This issue can be resolved by editing nph-maillist.pl . There is a section with several lines like:

if ($FORM{'emailaddress'} !~ /\@/) { &bad_email();}

Add the following two lines to that section:

if ($FORM{'emailaddress'} =~ /\;/) { &bad_email();}

if ($FORM{'emailaddress'} =~ /\`/) { &bad_email();}

nph-maillist Arbitrary Code Execution Vulnerability

References:

• The Email List Generator (Matt Tourtillott)