|
|
Info |
Last Modified |
| 7 months ago |
|
|
|
|
Description |
Sendmail contains a flaw that may allow a remote attacker to execute commands without authentication. The issue is triggered when an attacker connects to the SMTP service (port 25), and issues the 'debug' command. If enable, this may allow an attacker to pipe arbitrary commands that will be executed under the same privileges as sendmail.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Misconfiguration
Impact:
Loss of Integrity
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
OSVDB:
Wormified
|
|
Solution |
Upgrade to version 5.59 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: disable the 'decode' alias
|
|
Products |
|
Sendmail
 |
5.58 |
5.57 |
5.56 |
|
|
|
|
|
|
|
Credit |
Unknown or Incomplete
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
