W3Mail Remote Arbitrary Command Execution Vulnerability
BID:3673
Info
W3Mail Remote Arbitrary Command Execution Vulnerability
| Bugtraq ID: | 3673 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 07 2001 12:00AM |
| Updated: | Oct 07 2001 12:00AM |
| Credit: | Discovered by Emanuel Almeida <[email protected]> and posted to the BugTraq mailing list on October 7, 2001. |
| Vulnerable: |
CascadeSoft W3Mail 1.0.2 |
| Not Vulnerable: |
CascadeSoft W3Mail 1.0.3 |
Discussion
W3Mail Remote Arbitrary Command Execution Vulnerability
W3Mail is a full featured open source web mail application implemented as a collection of Perl scripts that runs on Linux and Unix systems. It includes support for sending mail.
When sending email, values passed as script parameters are used as part of a shell command. Shell meta characters are not properly filtered from this input. A maliciously formed URL submitted to the script could contain additional shell commands, which would then be executed by the web server user (generally 'nobody'). As a result, an attacker may execute arbitrary code on the vulnerable server.
Earlier versions of W3Mail may also be vulnerable.
W3Mail is a full featured open source web mail application implemented as a collection of Perl scripts that runs on Linux and Unix systems. It includes support for sending mail.
When sending email, values passed as script parameters are used as part of a shell command. Shell meta characters are not properly filtered from this input. A maliciously formed URL submitted to the script could contain additional shell commands, which would then be executed by the web server user (generally 'nobody'). As a result, an attacker may execute arbitrary code on the vulnerable server.
Earlier versions of W3Mail may also be vulnerable.
Exploit / POC
W3Mail Remote Arbitrary Command Execution Vulnerability
No exploit code is required to take advantage of this issue.
No exploit code is required to take advantage of this issue.
Solution / Fix
W3Mail Remote Arbitrary Command Execution Vulnerability
Solution:
Version 1.0.3 of W3Mail fixes this vulnerability.
Solution:
Version 1.0.3 of W3Mail fixes this vulnerability.