PGPMail.pl does not adequately validate user input thereby allowing arbitrary command execution

2002-09-27T00:00:00
ID VU:453475
Type cert
Reporter CERT
Modified 2003-04-15T00:00:00

Description

Overview

PGPMail.pl does not adequately filter user input, allowing arbitrary command execution.

Description

PGPMail.pl is an adaptation of the FormMail.pl CGI script, enhanced to use PGP encryption. PGPMail.pl does not adequately filter the "recipient" and "pgpuserid" CGI variables before passing them to piped Perl open() function calls, inevoking shells. As a result, attackers may execute arbitrary commands on the server with privileges of the web server process.


Impact

Remote attackers can execute arbitrary commands on the server with privileges of the web server process.


Solution

The CERT/CC is currently unaware of a practical solution to this problem.


Systems Affected

Vendor| Status| Date Notified| Date Updated
---|---|---|---
Ventura Blvd| | -| 25 Sep 2002
If you are a vendor and your product is affected, let us know.

CVSS Metrics

Group | Score | Vector
---|---|---
Base | N/A | N/A
Temporal | N/A | N/A
Environmental | N/A | N/A

References

  • <http://www.venturablvd.com/pgpmail/>

Credit

Thanks to John Scimone for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

  • CVE IDs: Unknown
  • Date Public: 29 Nov 2001
  • Date First Published: 27 Sep 2002
  • Date Last Updated: 15 Apr 2003
  • Severity Metric: 4.28
  • Document Revision: 6