Open WebMail vacation.pl Arbitrary Command Execution

high Nessus Plugin ID 12637

Language:

Synopsis

Arbitrary commands may be run on the remote host.

Description

The target is running at least one instance of Open WebMail in which the vacation.pl component fails to sufficiently validate user input. This failure enables remote attackers to execute arbitrary programs on a target using the privileges under which the web server operates. For further information, see :

http://www.openwebmail.org/openwebmail/download/cert/advisories/SA-04:04.txt

If safe_checks are disabled, Nessus attempts to create the file /tmp/nessus_openwebmail_vacation_input_validation on the target.

Solution

Upgrade to Open WebMail version 2.32 20040629 or later.

Plugin Details

Severity: High

ID: 12637

File Name: openwebmail_vacation_input_validation.nasl

Version: 1.19

Type: Remote

Family: CGI abuses

Published: 7/6/2004

Updated: 8/15/2022

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

Exploit Ease: No exploit is required

Vulnerability Publication Date: 7/6/2004

Reference Information

CVE: CVE-2004-2284

BID: 10637

Detections

Analytics