procmail in Ingo H3 before 1.1.2 Horde module allows remote authenticated users to execute arbitrary commands via shell metacharacters in the mailbox destination of a filter rule.

The remote host is affected by the vulnerability described in GLSA-200611-22 (Ingo H3: Folder name shell command injection)

    Ingo H3 fails to properly escape shell metacharacters in procmail     rules.
  Impact :

    A remote authenticated attacker could craft a malicious rule which     could lead to the execution of arbitrary shell commands on the server.
  Workaround :

    Don't use procmail with Ingo H3.

It was discovered that the Ingo email filter rules manager performs insufficient escaping of user-provided data in created procmail rules files, which allows the execution of arbitrary shell commands.

According to its version number, the instance of Ingo installed on the remote host fails to properly sanitize mailbox destinations in filter rules. By using a folder name beginning with '|' as a mailbox destination, an authenticated, remote attacker may be able to exploit this issue to execute arbitrary code on the remote host, subject to the permissions of the web server user id.

The Horde team reports a vulnerability within Ingo, the filter management suite. The vulnerability is caused due to inadequete escaping, possibly allowing a local user to execute arbitrary shell commands via procmail.

ID	Name	Product	Family	Severity
23730	GLSA-200611-22 : Ingo H3: Folder name shell command injection	Nessus	Gentoo Local Security Checks	medium
22936	Debian DSA-1204-1 : ingo1 - missing input sanitising	Nessus	Debian Local Security Checks	medium
22900	Ingo Foldername Arbitrary Command Execution	Nessus	CGI abuses	medium
22882	FreeBSD : ingo -- local arbitrary shell command execution (18a14baa-5ee5-11db-ae08-0008743bf21a)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2006-5449

high

Tenable Plugins

medium

medium

medium

medium