AMaViS Arbitrary Command Execution Vulnerability

Bugtraq ID:	527
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jul 16 1999 12:00AM
Updated:	Jul 16 1999 12:00AM
Credit:	First posted to BugTraq by Chris McDonough <[email protected]> on July 16, 1999.
Vulnerable:	AMaViS AMaViS 0.2 pre-4
Not Vulnerable:

AMaViS Arbitrary Command Execution Vulnerability

AMaViS is a script-based email virus scanner that runs on Linux machines. The latest versions, (AMaViS 0.2.0Pre-4) allows for malicious users to insert arbitrary commands that AMaViS will unknowingly run as root in the subject header of messages with virus-infected attached files. The problem is in the scanmails script, detailed below:

cat <<EOF| ${mail} -s "VIRUS IN YOUR MAIL TO $7" $2

V I R U S A L E R T

Our viruschecker found a VIRUS in your email to "$7".
We stopped delivery of this email!

Now it is on you to check your system for viruses

For further information about this viruschecker see:
http://aachalon.de/AMaViS/
AMaViS - A Mail Virus Scanner, licenced GPL
EOF


$2 (which could be 'rm -rf /') will expand to a shell command, executed as root. The possible consequence of this being exploited is a remote root compromise.

AMaViS Arbitrary Command Execution Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

AMaViS Arbitrary Command Execution Vulnerability

Solution:
Christian Bricart released a fixed version (0.2.0-pre6) available at:

http://aachalon.de/AMaViS/

It now requires sed to be accessable on the machine it's used on.

--

The co-authors of AMaViS provided the following patch:

--- scanmails.orig Wed Jun 30 12:54:02 1999
+++ scanmails Wed Jun 30 12:54:15 1999
@@ -122,6 +122,50 @@

deliver=/usr/bin/procmail

+
############################################################
###
+# Chris McDonough informed us, that it is possible to
execute #
+# programs by sending an email, wich contains a virus and
has #
+# as return address something
like: #
+#
`/sbin/reboot`@softing.com #
+#
or
#
+# $(/sbin/reboot)
@softing.com #
+# The execution of the command (/sbin/reboot) is done by
the #
+# "mail" program. Therefore we parse the arguments in
order #
+# to substitute those characters to
nothing #
+
#
#
+# Wed Jun 30 11:47:55 MEST
1999 #
+
############################################################
###
+
+# substitute all "`","$(",")" to nothing
+receiver=${7//\`/}
+receiver=${receiver//\$\(/}
+receiver=${receiver//\)/}
+
+sender=${2//\`/}
+sender=${sender//\$\(/}
+sender=${sender//\)/}
+
+if [ "$sender" != "$2" -o "$receiver" != "$7" ] ; then
+ cat <<EOF | ${mail} -s "Intrusion???" ${mailto}
+
############################################################
###
+# Chris McDonough informed us, that it is possible to
execute #
+# programs by sending an email, wich contains a virus and
has #
+# as return address something
like: #
+#
\`/sbin/rebbot\`@softing.com #
+#
or
#
+# \$\(/sbin/rebbot\)
@softing.com #
+# The execution of the command (/sbin/rebbot) is done by
the #
+# "mail" program. Therefore we parse the arguments in
order #
+# to substitute those characters to
nothing #
+
#
#
+# Wed Jun 30 11:47:55 MEST
1999 #
+
############################################################
###
+ $7 or $2 is not a valid Email address
+ (changed to $receiver and $sender)!
+EOF
+fi
+#
+
################################################
# main program #
# -------------- #
@@ -171,8 +215,8 @@

echo xxxxxxxxxxxxxxxxxx`date`xxxxxxxxxxxxxxxxxxxxxxx >
${tmpdir}/logfile
echo ${scanscriptname} called $* >>${tmpdir}/logfile
-echo FROM: $2 >>/${tmpdir}/logfile
-echo TO: $7 >>/${tmpdir}/logfile
+echo FROM: $sender >>/${tmpdir}/logfile
+echo TO: $receiver >>/${tmpdir}/logfile

${metamail} -r -q -x -w ${tmpdir}/receivedmail > /dev/null
2>&1

@@ -597,11 +641,11 @@

################### send a mail back to sender
######################

-cat <<EOF| ${mail} -s "VIRUS IN YOUR MAIL TO $7" $2
+cat <<EOF| ${mail} -s "VIRUS IN YOUR MAIL TO $receiver"
$sender

V I R U S A L E R T

- Our viruschecker found a VIRUS in your email to "$7".
+ Our viruschecker found a VIRUS in your email to
"$receiver".
We stopped delivery of this email!

Now it is on you to check your system for
viruses
@@ -614,12 +658,12 @@

############### send a mail to the addressee
########################

-cat <<EOF| ${mail} -s "VIRUS IN A MAIL FOR YOU FROM $2" $7
+cat <<EOF| ${mail} -s "VIRUS IN A MAIL FOR YOU FROM
$sender" $receiver

V I R U S A L E R T

Our viruschecker found a VIRUS in a mail from
- "$2"
+ "$sender"
to you.

Delivery of the email was stopped!

AMaViS Arbitrary Command Execution Vulnerability

References: