ID OSVDB:6318 Type osvdb Reporter Brock Tellier(btellier@webley.com) Modified 1999-10-04T00:00:00
Description
Vulnerability Description
RPMMail contains a flaw that may allow a malicious user to obtain a root-shell. The issue is triggered when sending a mail with Shell metacharacters in the "MAIL FROM".
Solution Description
Upgrade to version 1.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
This version of rpmmail should not be vulnerable to this attack:
RPMMail contains a flaw that may allow a malicious user to obtain a root-shell. The issue is triggered when sending a mail with Shell metacharacters in the "MAIL FROM".
References:
Keyword: mail,metacharachters
ISS X-Force ID: 3353
CVE-1999-1542
{"type": "osvdb", "published": "1999-10-04T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:6318", "bulletinFamily": "software", "cvss": {"vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/", "score": 10.0}, "viewCount": 5, "edition": 1, "reporter": "Brock Tellier(btellier@webley.com)", "title": "RPMMail \"MAIL FROM\" Shell Metacharacter Command Execution", "affectedSoftware": [{"operator": "eq", "version": "1,0-1,4", "name": "RPMMail"}], "enchantments": {"score": {"value": 6.0, "vector": "NONE", "modified": "2017-04-28T13:20:01", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-1999-1542"]}], "modified": "2017-04-28T13:20:01", "rev": 2}, "vulnersScore": 6.0}, "references": [], "id": "OSVDB:6318", "lastseen": "2017-04-28T13:20:01", "cvelist": ["CVE-1999-1542"], "modified": "1999-10-04T00:00:00", "description": "## Vulnerability Description\nRPMMail contains a flaw that may allow a malicious user to obtain a root-shell. The issue is triggered when sending a mail with Shell metacharacters in the \"MAIL FROM\". \n## Solution Description\nUpgrade to version 1.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\nThis version of rpmmail should not be vulnerable to this attack:\n\nftp://reedycreek.com/reedycreek/rpmmaildemo/rpmmail-1.4.tar.gz\n\nftp://reedycreek.com/reedycreek/rpmmaildemo/rpmmail-1.4-2.i386.rpm \n## Short Description\nRPMMail contains a flaw that may allow a malicious user to obtain a root-shell. The issue is triggered when sending a mail with Shell metacharacters in the \"MAIL FROM\". \n## References:\nKeyword: mail,metacharachters\nISS X-Force ID: 3353\n[CVE-1999-1542](https://vulners.com/cve/CVE-1999-1542)\n"}
