PERL-MailTools Remote Command Execution Vulnerability
BID:6104
Info
PERL-MailTools Remote Command Execution Vulnerability
| Bugtraq ID: | 6104 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-1271 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 05 2002 12:00AM |
| Updated: | Jul 11 2009 06:06PM |
| Credit: | Discovery of this vulnerability credited to the SuSE Security Team. |
| Vulnerable: |
perl-MailTools perl-MailTools 1.1401 perl-MailTools perl-MailTools 1.47 perl-MailTools perl-MailTools 1.44 perl-MailTools perl-MailTools 1.42 perl-MailTools perl-MailTools 1.40 perl-MailTools perl-MailTools 1.15 perl-MailTools perl-MailTools 1.13 |
| Not Vulnerable: | |
Discussion
PERL-MailTools Remote Command Execution Vulnerability
A vulnerability has been reported for a module, included in the perl-MailTools package, which may allow remote attackers to execute arbitrary commands on the underlying shell with the privileges of the mailx process.
User-supplied input is passed to the mailx mailer, but is not sufficiently sanitized of shell metacharacters before being passed through the shell.
A vulnerability has been reported for a module, included in the perl-MailTools package, which may allow remote attackers to execute arbitrary commands on the underlying shell with the privileges of the mailx process.
User-supplied input is passed to the mailx mailer, but is not sufficiently sanitized of shell metacharacters before being passed through the shell.
Exploit / POC
PERL-MailTools Remote Command Execution Vulnerability
There is no exploit code required.
There is no exploit code required.
References
PERL-MailTools Remote Command Execution Vulnerability
References:
References:
- [Security Announce] Re: MDKSA-2002:076 - perl-MailTools update (Vincent Danen