Courier-IMAP: remote execution of arbitrary code
| Package(s): | courier-imap | CVE #(s): | |||||
| Created: | April 23, 2007 | Updated: | April 25, 2007 | ||||
| Description: | CJ Kucera has discovered that some Courier-IMAP scripts don't properly handle the XMAILDIR variable, allowing for shell command injection. A remote attacker could send specially crafted login credentials to a Courier-IMAP server instance, possibly leading to remote code execution with root privileges. | ||||||
| Alerts: |
| ||||||
The LWN site is currently under high scraper load, so comment display has been suppressed for anonymous users. If you are a human, you may read the comments by clicking the button below:
Note: you can avoid this step in the future by logging into your LWN account.