Nessus Plugin #15529

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Open WebMail userstat.pl Arbitrary Command Execution

Family:

Gain a shell remotely

Category:

attack

Copyright:

This script is Copyright (C) 2004 George A. Theall

Summary:

Checks for Arbitrary Command Execution flaw in Open WebMail's userstat.pl

Version:

$Revision: 1.1 $

Cve_id:

-

Bugtraq_id:

10316

Xrefs:

OSVDB:4201

Description:

The target is running at least one instance of Open WebMail in which
the userstat.pl component fails to sufficiently validate user input.
This failure enables remote attackers to execute arbitrary programs on
the target using the privileges under which the web server operates.
For further information, see :

http://www.openwebmail.org/openwebmail/download/cert/advisories/SA-04:01.txt

Solution : Upgrade to Open WebMail version 2.30 20040127 or later.

Risk factor : High