Nessus Plugin #12637

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Open WebMail vacation.pl Arbitrary Command Execution

Family:

Gain a shell remotely

Category:

infos

Copyright:

This script is Copyright (C) 2004 George A. Theall

Summary:

Checks for Arbitrary Command Execution flaw in Open WebMail's vacation.pl

Version:

$Revision: 1.7 $

Cve_id:

-

Bugtraq_id:

10637

Xrefs:

OSVDB:7474

Description:

The target is running at least one instance of Open WebMail in which
the vacation.pl component fails to sufficiently validate user input.
This failure enables remote attackers to execute arbitrary programs on
a target using the privileges under which the web server operates.
For further information, see :

http://www.openwebmail.org/openwebmail/download/cert/advisories/SA-04:04.txt

If safe_checks are disabled, Nessus attempts to create the file
/tmp/nessus_openwebmail_vacation_input_validation on the target.

Solution : Upgrade to Open WebMail version 2.32 20040629 or later.

Risk factor : High