qpopper < 3.0.1b2 EIUDL Arbitrary Command Execution

Medium Nessus Network Monitor Plugin ID 1784

Synopsis

An attacker can gain an unprivileged shell on the remote system.

Description

The system is using qpopper 2.53 (or newer in the 2.5x series). There is a problem in this server that allows users who have a pop account to gain a shell with the gid 'mail' by sending to themselves a specially crafted mail.

Solution

Upgrade to version 3.0.1b2 or higher.

Plugin Details

Severity: Medium

ID: 1784

Family: POP Server

Published: 2004/08/20

Updated: 2019/03/06

Dependencies: 3035

Nessus ID: 10423

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 6.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

Temporal Vector: CVSS2#E:H/RL:W/RC:ND

CVSS v3.0

Base Score: 6.2

Temporal Score: 6

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:H/RL:W/RC:X

Vulnerability Information

CPE: cpe:/a:qualcomm:qpopper

Reference Information

CVE: CVE-2000-0320

BID: 1133