smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote
    attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell
    metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue
    exists because of an incorrect return value upon failure of input validation. (CVE-2020-7247)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4875-1 advisory.

    It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under     certain conditions. An attacker could possibly use this vulnerability to execute arbitrary commands as     root. (CVE-2020-7247)

    It was discovered that OpenSMTPD did not properly handle hardlinks under certain conditions. An     unprivileged local attacker could possibly use this issue to obtain sensitive information. This issue only     affected Ubuntu 16.04 ESM. (CVE-2020-8793)

    It was discovered that OpenSMTPD mishandled certain input. A remote, unauthenticated attacker could     possibly use this vulnerability to execute arbitrary shell commands as any non-root user. This issue only     affected Ubuntu 16.04 ESM. (CVE-2020-8794)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A remote code execution vulnerability exists in OpenSMTPD  due to unsanitized email inputs. An unauthenticated,  remote attacker can exploit this to bypass authentication  and execute arbitrary commands with root privileges.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4268-1 advisory.

    It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under     certain conditions. An attacker could use this vulnerability to execute arbitrary commands as root.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

OpenSMTPD developers report :

An incorrect check allows an attacker to trick mbox delivery into executing arbitrary commands as root and lmtp delivery into executing arbitrary commands as an unprivileged user

Qualys discovered that the OpenSMTPD SMTP server performed insufficient validation of email addresses which could result in the execution of arbitrary commands as root. In addition this update fixes a denial of service by triggering an opportunistic TLS downgrade.

ID	Name	Product	Family	Type	Severity
406032	Alpine: multiple opensmtpd packages: security update to 6.6.2p1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
406032	Alpine: multiple opensmtpd packages: security update to 6.6.2p1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
183572	Ubuntu 16.04 ESM : OpenSMTPD vulnerabilities (USN-4875-1)	Nessus	Ubuntu Local Security Checks	Local	critical
133717	OpenSMTPD Critical LPE / RCE (CVE-2020-7247)	Nessus	SMTP problems	Remote	critical
133522	Ubuntu 18.04 LTS : OpenSMTPD vulnerability (USN-4268-1)	Nessus	Ubuntu Local Security Checks	Local	critical
133327	FreeBSD : OpenSMTPd -- critical LPE / RCE vulnerability (08f5c27d-4326-11ea-af8b-00155d0a0200)	Nessus	FreeBSD Local Security Checks	Local	critical
133326	Debian DSA-4611-1 : opensmtpd - security update	Nessus	Debian Local Security Checks	Local	critical

Detections

Analytics

CVE-2020-7247

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical