CVEvulnerability
CVE-2010-1132
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2010-03-27
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-78
Description
The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message.
Affected configurations
• georg greve spamassassin milter plugin 0.3.1
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html Exploit
- http://bugs.debian.org/573228 bugs.debian.org
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038535.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038572.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038777.html lists.fedoraproject.org
- http://osvdb.org/62809 osvdb.org
- http://secunia.com/advisories/38840 Vendor Advisory
- http://secunia.com/advisories/38956 Vendor Advisory
- http://secunia.com/advisories/39265 Vendor Advisory
- http://www.debian.org/security/2010/dsa-2021 www.debian.org
- http://www.exploit-db.com/exploits/11662 Exploit
- http://www.securityfocus.com/bid/38578 Exploit
- http://www.securitytracker.com/id?1023691 www.securitytracker.com
- http://www.vupen.com/english/advisories/2010/0559 Vendor Advisory
- http://www.vupen.com/english/advisories/2010/0683 Vendor Advisory
- http://www.vupen.com/english/advisories/2010/0837 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=572117 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56732 exchange.xforce.ibmcloud.com
- https://savannah.nongnu.org/bugs/?29136 savannah.nongnu.org
- http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html Exploit
- http://bugs.debian.org/573228 bugs.debian.org
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038535.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038572.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038777.html lists.fedoraproject.org
- http://osvdb.org/62809 osvdb.org
- http://secunia.com/advisories/38840 Vendor Advisory
- http://secunia.com/advisories/38956 Vendor Advisory
- http://secunia.com/advisories/39265 Vendor Advisory
- http://www.debian.org/security/2010/dsa-2021 www.debian.org
- http://www.exploit-db.com/exploits/11662 Exploit
- http://www.securityfocus.com/bid/38578 Exploit
- http://www.securitytracker.com/id?1023691 www.securitytracker.com
- http://www.vupen.com/english/advisories/2010/0559 Vendor Advisory
- http://www.vupen.com/english/advisories/2010/0683 Vendor Advisory
- http://www.vupen.com/english/advisories/2010/0837 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=572117 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56732 exchange.xforce.ibmcloud.com
- https://savannah.nongnu.org/bugs/?29136 savannah.nongnu.org