Debian DSA-078-1 : slrn - remote command invocation

Byrial Jensen found a nasty problem in slrn a threaded news reader. The notice on slrn-announce describes it as follows : When trying to decode binaries, the built-in code executes any shell scripts the article might contain, apparently assuming they would be some kind of self-extracting archive...

CVE-2001-1035

Binary decoding feature of slrn 0.9 and earlier allows remote attackers to execute commands via shell scripts that are inserted into a news post...

CVE-2001-1035

The CVE-2001-1035 issue affects slrn up to version 0.9 and earlier, where the binary decoding feature would execute shell scripts embedded in news posts. Exploitation could allow remote attackers to run commands on the affected host. Public references in Debian’s DSA-078-1 (slrn) describe this as...