OSVDB ID: 196 Title: Sendmail decode Alias Arbitrary File Overwrite |
Info |
|
|
Dates |
||||
|
|
Description |
Sendmail contains a flaw that may allow a remote attacker to overwrite arbitrary files. The issue is due tot he program allowing remote access to the 'decode' alias. By sending a crafted email to the alias, the sendmail program would write user-supplied content to an arbitrary file as well as set custom permissions. |
Classification |
Location:
Remote / Network Access
Attack Type: Misconfiguration Impact: Loss of Integrity, Loss of Availability Exploit: Exploit Public Disclosure: OSVDB Verified |
Solution |
Upgrade to version 5.67 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: disable the 'decode' alias |
Products |
|
References |
|
Credit |
Unknown or Incomplete |