Exim for Dovecot 'use_shell' Remote Command Execution Vulnerability

Bugtraq ID:	60465
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 10 2013 12:00AM
Updated:	Jun 10 2013 12:00AM
Credit:	RedTeam Pentesting GmbH
Vulnerable:	Dovecot Dovecot 2.0.13 Dovecot Dovecot 2.0.12 Dovecot Dovecot 2.0.4 Dovecot Dovecot 2.0.3 Dovecot Dovecot 2.0.2 Dovecot Dovecot 1.2.17 Dovecot Dovecot 1.2.16 Dovecot Dovecot 1.2.15 Dovecot Dovecot 1.2.14 Dovecot Dovecot 1.2.13 Dovecot Dovecot 1.2.12 Dovecot Dovecot 1.2.10 Dovecot Dovecot 1.2.9 Dovecot Dovecot 1.2.8 Dovecot Dovecot 1.2.7 Dovecot Dovecot 2.0.5 Dovecot Dovecot 2.0.3 Dovecot Dovecot 2.0.16 Dovecot Dovecot 2.0.15 Dovecot Dovecot 2.0.1 Dovecot Dovecot 2.0 Dovecot Dovecot 1.2.11
Not Vulnerable:

Exim for Dovecot 'use_shell' Remote Command Execution Vulnerability

Exim for Dovecot is prone to a remote command-execution vulnerability.

Successful exploits will allow remote attackers to execute arbitrary commands within the context of the affected application.

Exim for Dovecot 'use_shell' Remote Command Execution Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/60465.rb

Exim for Dovecot 'use_shell' Remote Command Execution Vulnerability

Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

Exim for Dovecot 'use_shell' Remote Command Execution Vulnerability

References:

• Dovecot Homepage (Dovecot)
  
• Exim Homepage (Exim)