CVE-2010-1132 | BDVDB-2026-40909 Detail
Description#
The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://www.vupen.com/english/advisories/2010/0559
- http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html
- http://www.vupen.com/english/advisories/2010/0683
- http://secunia.com/advisories/39265
- http://www.vupen.com/english/advisories/2010/0837
- http://www.securityfocus.com/bid/38578
- https://bugzilla.redhat.com/show_bug.cgi?id=572117
- http://www.debian.org/security/2010/dsa-2021
- https://savannah.nongnu.org/bugs/?29136
- http://www.exploit-db.com/exploits/11662
- http://bugs.debian.org/573228
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038535.html
- http://www.securitytracker.com/id?1023691
- http://osvdb.org/62809
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56732
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.