OSVDB ID: 195 Title: Sendmail debug Arbitrary Command Execution |
Info |
|
|
Dates |
||||
|
|
Description |
Sendmail contains a flaw that may allow a remote attacker to execute commands without authentication. The issue is triggered when an attacker connects to the SMTP service (port 25), and issues the 'debug' command. If enable, this may allow an attacker to pipe arbitrary commands that will be executed under the same privileges as sendmail. |
Classification |
Location:
Remote / Network Access
Attack Type: Misconfiguration Impact: Loss of Integrity Exploit: Exploit Public, Exploit Wormified Disclosure: OSVDB Verified |
Solution |
Upgrade to version 5.59 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: disable the 'decode' alias |
Products |
|
References |
|
Credit |
Unknown or Incomplete |