QPopper PopAuth Trace File Shell Command Execution Vulnerability

Bugtraq ID:	3710
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 18 2001 12:00AM
Updated:	Dec 18 2001 12:00AM
Credit:	This vulnerability was announced by Paul Starzetz <[email protected]> via Bugtraq on December 17, 2001.
Vulnerable:	Qualcomm qpopper 4.0.3 + Caldera OpenServer 5.0.6 + Caldera OpenServer 5.0.5 Qualcomm qpopper 4.0.2 Qualcomm qpopper 4.0.1 + Redhat Linux 7.1 + Redhat Linux 7.0 + Sun Cobalt RaQ 4
Not Vulnerable:

QPopper PopAuth Trace File Shell Command Execution Vulnerability

Qpopper is a freely available, open source Post Office Protocol server. It is maintained and distributed by Qualcomm.

When popauth is executed with the trace option, it does not correctly handle user-supplied input. A user can supply data to the popauth program through the trace flag which will cause the program to execute shell commands, and follow symbolic links.

This problem could be exploited to gain privilege elevation equal to that of the setuid bit on popauth, typically setuid as the pop user.

QPopper PopAuth Trace File Shell Command Execution Vulnerability

Exploit contributed by Paul Starzetz <[email protected]>.

• /data/vulnerabilities/exploits/mkbs2.sh

QPopper PopAuth Trace File Shell Command Execution Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

QPopper PopAuth Trace File Shell Command Execution Vulnerability

References: