vpopmail-CGIApps Remote Command Execution Vulnerability

Bugtraq ID:	6037
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 24 2002 12:00AM
Updated:	Oct 24 2002 12:00AM
Credit:	Discovery credited to Ignacio Vazquez.
Vulnerable:	vpopmail-CGIApps vpopmail-CGIApps 0.2
Not Vulnerable:	vpopmail-CGIApps vpopmail-CGIApps 0.3

vpopmail-CGIApps Remote Command Execution Vulnerability

A remote command execution vulnerability has been discovered in vpopmail-CGIApps v0.2.

Due to insufficient sanitization of user domain form field, it is possible to insert malicious commands into the field, which later get executed by the system.

Exploiting this issue allows a remote attacker to execute arbitrary system commands with the permissions of the mail server.

vpopmail-CGIApps Remote Command Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

vpopmail-CGIApps Remote Command Execution Vulnerability

Solution:
The vendor has confirmed this issue and address it in the latest version of the software. Users are advised to upgrade to the latest release.


vpopmail-CGIApps vpopmail-CGIApps 0.2

• vpopmail-CGIApps vpopmail-CGIApps v0.3
  http://diario.buscadoc.org/index.php?topic=Programas

vpopmail-CGIApps Remote Command Execution Vulnerability

References: