c2faxrecv in capi4hylafax 01.02.03 allows remote attackers to execute arbitrary commands via null (\0) and shell metacharacters in the TSI string, as demonstrated by a fax from an anonymous number.

By using shell meta characters in the sender number remote attackers could execute arbitrary commands. (CVE-2006-3126)

By using shell meta characters in the sender number remote attackers could execute arbitrary commands (CVE-2006-3126).

The remote host is affected by the vulnerability described in GLSA-200610-05 (CAPI4Hylafax fax receiver: Execution of arbitrary code)

    Lionel Elie Mamane discovered an error in c2faxrecv, which doesn't     properly sanitize TSI strings when handling incoming calls.
  Impact :

    A remote attacker can send null (\\0) and shell metacharacters in the     TSI string from an anonymous fax number, leading to the execution of     arbitrary code with the rights of the user running c2faxrecv.
  Workaround :

    There is no known workaround at this time.

Lionel Elie Mamane discovered a security vulnerability in capi4hylafax, tools for faxing over a CAPI 2.0 device, that allows remote attackers to execute arbitrary commands on the fax receiving system.

ID	Name	Product	Family	Severity
29390	SuSE 10 Security Update : capi4hylafax (ZYPP Patch Number 2378)	Nessus	SuSE Local Security Checks	high
27170	openSUSE 10 Security Update : capi4hylafax (capi4hylafax-2366)	Nessus	SuSE Local Security Checks	high
22891	GLSA-200610-05 : CAPI4Hylafax fax receiver: Execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
22707	Debian DSA-1165-1 : capi4hylafax - missing input sanitising	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2006-3126

critical

Tenable Plugins

high

high

high

high