{"id": "1CAE628C-3569-11E0-8E81-0022190034C0", "bulletinFamily": "unix", "title": "rubygem-mail -- Remote Arbitrary Shell Command Injection Vulnerability", "description": "\nSecunia reports:\n\nInput passed via an email from address is not properly sanitised\n\t in the \"deliver()\" function (lib/mail/network/delivery_methods/sendmail.rb)\n\t before being used as a command line argument. This can be exploited\n\t to inject arbitrary shell commands.\n\n", "published": "2011-01-25T00:00:00", "modified": "2011-01-25T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "href": "https://vuxml.freebsd.org/freebsd/1cae628c-3569-11e0-8e81-0022190034c0.html", "reporter": "FreeBSD", "references": ["http://secunia.com/advisories/43077/", "http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1"], "cvelist": ["CVE-2011-0739"], "type": "freebsd", "lastseen": "2019-05-29T18:34:01", "edition": 4, "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2011-0739"]}, {"type": "openvas", "idList": ["OPENVAS:68946", "OPENVAS:136141256231068946"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_1CAE628C356911E08E810022190034C0.NASL"]}, {"type": "github", "idList": ["GHSA-CPJC-P7FC-J9XH"]}], "modified": "2019-05-29T18:34:01", "rev": 2}, "score": {"value": 6.4, "vector": "NONE", "modified": "2019-05-29T18:34:01", "rev": 2}, "vulnersScore": 6.4}, "affectedPackage": [{"OS": "FreeBSD", "OSVersion": "any", "arch": "noarch", "operator": "lt", "packageFilename": "UNKNOWN", "packageName": "rubygem-mail", "packageVersion": "2.2.15"}], "scheme": null}

{"cve": [{"lastseen": "2021-02-02T05:50:59", "description": "The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address.", "edition": 6, "cvss3": {}, "published": "2011-02-02T01:00:00", "title": "CVE-2011-0739", "type": "cve", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-0739"], "modified": "2017-08-17T01:33:00", "cpe": ["cpe:/a:mikel_lindsaar:mail:1.2.6", "cpe:/a:mikel_lindsaar:mail:2.2.0", "cpe:/a:mikel_lindsaar:mail:1.5.0", "cpe:/a:mikel_lindsaar:mail:2.2.6.1", "cpe:/a:mikel_lindsaar:mail:1.3.2", "cpe:/a:mikel_lindsaar:mail:2.1.5.2", "cpe:/a:mikel_lindsaar:mail:2.2.7", "cpe:/a:mikel_lindsaar:mail:2.2.12", "cpe:/a:mikel_lindsaar:mail:2.2.10", "cpe:/a:mikel_lindsaar:mail:2.0.3", "cpe:/a:mikel_lindsaar:mail:2.2.14", "cpe:/a:mikel_lindsaar:mail:1.2.8", "cpe:/a:mikel_lindsaar:mail:1.5.1", "cpe:/a:mikel_lindsaar:mail:2.1.0", "cpe:/a:mikel_lindsaar:mail:1.0.0", "cpe:/a:mikel_lindsaar:mail:2.1.1", "cpe:/a:mikel_lindsaar:mail:2.2.13", "cpe:/a:mikel_lindsaar:mail:1.5.4", "cpe:/a:mikel_lindsaar:mail:1.3.4", "cpe:/a:mikel_lindsaar:mail:2.2.4", "cpe:/a:mikel_lindsaar:mail:2.1.5", "cpe:/a:mikel_lindsaar:mail:1.2.7", "cpe:/a:mikel_lindsaar:mail:2.2.5", "cpe:/a:mikel_lindsaar:mail:2.1.5.3", "cpe:/a:mikel_lindsaar:mail:1.6.0", "cpe:/a:mikel_lindsaar:mail:1.3.1", "cpe:/a:mikel_lindsaar:mail:1.2.9", "cpe:/a:mikel_lindsaar:mail:1.3.3", "cpe:/a:mikel_lindsaar:mail:2.1.2", "cpe:/a:mikel_lindsaar:mail:2.2.2", "cpe:/a:mikel_lindsaar:mail:1.4.2", "cpe:/a:mikel_lindsaar:mail:1.2.1", "cpe:/a:mikel_lindsaar:mail:1.1.0", "cpe:/a:mikel_lindsaar:mail:1.2.5", "cpe:/a:mikel_lindsaar:mail:2.2.3", "cpe:/a:mikel_lindsaar:mail:2.2.6", "cpe:/a:mikel_lindsaar:mail:1.5.3", "cpe:/a:mikel_lindsaar:mail:2.2.9.1", "cpe:/a:mikel_lindsaar:mail:1.4.3", "cpe:/a:mikel_lindsaar:mail:2.2.11", "cpe:/a:mikel_lindsaar:mail:2.1.3", "cpe:/a:mikel_lindsaar:mail:1.4.0", "cpe:/a:mikel_lindsaar:mail:2.2.5.2", "cpe:/a:mikel_lindsaar:mail:2.2.1", "cpe:/a:mikel_lindsaar:mail:2.1.5.1", "cpe:/a:mikel_lindsaar:mail:1.3.5", "cpe:/a:mikel_lindsaar:mail:1.3.0", "cpe:/a:mikel_lindsaar:mail:2.0.5", "cpe:/a:mikel_lindsaar:mail:1.4.1", "cpe:/a:mikel_lindsaar:mail:2.2.5.1", "cpe:/a:mikel_lindsaar:mail:2.2.9", "cpe:/a:mikel_lindsaar:mail:1.5.2"], "id": "CVE-2011-0739", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0739", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:mikel_lindsaar:mail:1.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.1.1:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.1.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.1.2:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.13:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.14:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.9.1:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.11:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.1.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:1.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:mikel_lindsaar:mail:2.1.5.3:*:*:*:*:*:*:*"]}], "openvas": [{"lastseen": "2019-05-29T18:39:42", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0739"], "description": "The remote host is missing an update to the system\n as announced in the referenced advisory.", "modified": "2019-03-14T00:00:00", "published": "2011-03-05T00:00:00", "id": "OPENVAS:136141256231068946", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231068946", "type": "openvas", "title": "FreeBSD Ports: rubygem-mail", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: freebsd_rubygem-mail.nasl 14170 2019-03-14 09:24:12Z cfischer $\n#\n# Auto generated from VID 1cae628c-3569-11e0-8e81-0022190034c0\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.68946\");\n script_version(\"$Revision: 14170 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-14 10:24:12 +0100 (Thu, 14 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-03-05 22:25:39 +0100 (Sat, 05 Mar 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2011-0739\");\n script_bugtraq_id(46021);\n script_name(\"FreeBSD Ports: rubygem-mail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsd\", \"ssh/login/freebsdrel\");\n\n script_tag(name:\"insight\", value:\"The following package is affected: rubygem-mail\n\nCVE-2011-0739\nThe deliver function in the sendmail delivery agent\n(lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem\n2.2.14 and earlier allows remote attackers to execute arbitrary\ncommands via shell metacharacters in an e-mail address.\");\n\n script_tag(name:\"solution\", value:\"Update your system with the appropriate patches or\n software upgrades.\");\n\n script_xref(name:\"URL\", value:\"http://secunia.com/advisories/43077/\");\n script_xref(name:\"URL\", value:\"http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1\");\n script_xref(name:\"URL\", value:\"http://www.vuxml.org/freebsd/1cae628c-3569-11e0-8e81-0022190034c0.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update to the system\n as announced in the referenced advisory.\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-bsd.inc\");\n\nvuln = FALSE;\ntxt = \"\";\n\nbver = portver(pkg:\"rubygem-mail\");\nif(!isnull(bver) && revcomp(a:bver, b:\"2.2.15\")<0) {\n txt += 'Package rubygem-mail version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = TRUE;\n}\n\nif(vuln) {\n security_message(data:txt);\n} else if (__pkg_match) {\n exit(99);\n}", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2017-07-02T21:13:32", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0739"], "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "modified": "2017-02-25T00:00:00", "published": "2011-03-05T00:00:00", "id": "OPENVAS:68946", "href": "http://plugins.openvas.org/nasl.php?oid=68946", "type": "openvas", "title": "FreeBSD Ports: rubygem-mail", "sourceData": "#\n#VID 1cae628c-3569-11e0-8e81-0022190034c0\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from VID 1cae628c-3569-11e0-8e81-0022190034c0\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following package is affected: rubygem-mail\n\nCVE-2011-0739\nThe deliver function in the sendmail delivery agent\n(lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem\n2.2.14 and earlier allows remote attackers to execute arbitrary\ncommands via shell metacharacters in an e-mail address.\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://secunia.com/advisories/43077/\nhttp://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1\nhttp://www.vuxml.org/freebsd/1cae628c-3569-11e0-8e81-0022190034c0.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\n\nif(description)\n{\n script_id(68946);\n script_version(\"$Revision: 5424 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-02-25 17:52:36 +0100 (Sat, 25 Feb 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-03-05 22:25:39 +0100 (Sat, 05 Mar 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_cve_id(\"CVE-2011-0739\");\n script_bugtraq_id(46021);\n script_name(\"FreeBSD Ports: rubygem-mail\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"rubygem-mail\");\nif(!isnull(bver) && revcomp(a:bver, b:\"2.2.15\")<0) {\n txt += 'Package rubygem-mail version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2021-01-07T10:40:15", "description": "Secunia reports :\n\nInput passed via an email from address is not properly sanitised in\nthe 'deliver()' function\n(lib/mail/network/delivery_methods/sendmail.rb) before being used as a\ncommand line argument. This can be exploited to inject arbitrary shell\ncommands.", "edition": 26, "published": "2011-02-14T00:00:00", "title": "FreeBSD : rubygem-mail -- Remote Arbitrary Shell Command Injection Vulnerability (1cae628c-3569-11e0-8e81-0022190034c0)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2011-0739"], "modified": "2011-02-14T00:00:00", "cpe": ["cpe:/o:freebsd:freebsd", "p-cpe:/a:freebsd:freebsd:rubygem-mail"], "id": "FREEBSD_PKG_1CAE628C356911E08E810022190034C0.NASL", "href": "https://www.tenable.com/plugins/nessus/51962", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(51962);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2011-0739\");\n script_bugtraq_id(46021);\n script_xref(name:\"Secunia\", value:\"43077\");\n\n script_name(english:\"FreeBSD : rubygem-mail -- Remote Arbitrary Shell Command Injection Vulnerability (1cae628c-3569-11e0-8e81-0022190034c0)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Secunia reports :\n\nInput passed via an email from address is not properly sanitised in\nthe 'deliver()' function\n(lib/mail/network/delivery_methods/sendmail.rb) before being used as a\ncommand line argument. This can be exploited to inject arbitrary shell\ncommands.\"\n );\n # http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?a5e52760\"\n );\n # https://vuxml.freebsd.org/freebsd/1cae628c-3569-11e0-8e81-0022190034c0.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?6d34a663\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:rubygem-mail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2011/01/25\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2011/02/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2011/02/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2011-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"rubygem-mail<2.2.15\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "github": [{"lastseen": "2020-03-10T23:26:17", "bulletinFamily": "software", "cvelist": ["CVE-2011-0739"], "description": "The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address.", "edition": 2, "modified": "2019-07-03T21:02:00", "published": "2017-10-24T18:33:38", "id": "GHSA-CPJC-P7FC-J9XH", "href": "https://github.com/advisories/GHSA-cpjc-p7fc-j9xh", "title": "Moderate severity vulnerability that affects mail", "type": "github", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}]}