Title: Multiple Vendor Mail Reply-To Field Vulnerability
Severity: LOW
Description:
mail is a simple console e-mail client. A vulnerability exists in several vendors' distributions of this program.
An attacker can compose an email message with a carefully-formed string in the Reply-To: field which includes shell meta-characters, and send it to a victim/recipient.
Upon receipt of this message, the recipient might normally see the dangerous text in the Reply-to field and delete the message without responding.
However, the field can be formed in such a way that these extra characters are concealed. By including a series of ^H characters, the attacker can affect the text in the field as it is displayed on the recipient's screen. As a result, the victim has no visible indication that the message variables (eg, from and reply-to) are malformed.
If the message elicits a response from the user, the contents of the reply-to field will be interpreted as a reference to a pre-existing file in /tmp, placed earlier by the attacker, which can contain arbitrary shell commands. This can grant the attacker an elevation of privileges, to that of his victim, and possibly root (if root replies to the dangerous email..).
Affected Products:
- Caldera OpenLinux 2.4.0
- Debian Linux 2.2.0
- Debian Linux 2.3.0
- RedHat Linux 6.2.0 E alpha
- RedHat Linux 6.2.0 E i386
- RedHat Linux 6.2.0 E sparc
- RedHat Linux 6.2.0 alpha
- RedHat Linux 6.2.0 i386
- RedHat Linux 6.2.0 sparc
- RedHat Linux 7.0.0
- SGI IRIX 5.2.0
- SGI IRIX 5.3.0
- SGI IRIX 6.3.0
- Sun Solaris 2.4.0_x86
- Sun Solaris 2.5.0
- Sun Solaris 2.5.0_x86
- Sun Solaris 2.5.1
- Sun Solaris 2.5.1_ppc
- Sun Solaris 2.5.1_x86
- Sun Solaris 2.6
- Sun Solaris 2.6.0_x86HW3/98
- Sun Solaris 2.6_x86
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
