Vulnerabilities > CVE-2010-1132 - OS Command Injection vulnerability in Georg Greve Spamassassin Milter Plugin 0.3.1

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
georg-greve
CWE-78
critical
nessus
exploit available

Summary

The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message.

Vulnerable Configurations

Part Description Count
Application
Georg_Greve
1

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
  • Command Delimiters
    An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or a blacklist input validation, as opposed to whitelist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or blacklist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
  • Exploiting Multiple Input Interpretation Layers
    An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a "layer" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.
  • Argument Injection
    An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.
  • OS Command Injection
    In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.

Exploit-Db

descriptionApache Spamassassin Milter Plugin Remote Root Command Execution. CVE-2010-1132. Remote exploits for multiple platform
fileexploits/multiple/remote/11662.txt
idEDB-ID:11662
last seen2016-02-01
modified2010-03-09
platformmultiple
port
published2010-03-09
reporterkingcope
sourcehttps://www.exploit-db.com/download/11662/
titleApache Spamassassin Milter Plugin 0.3.1 - Remote Root Command Execution
typeremote

Nessus

  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_7132C84258E211DF8D800015587E2CC1.NASL
    descriptionThe spamassassin milter plugin contains a vulnerability that can allow remote attackers to execute commands on affected systems. The vulnerability can be exploited trough a special-crafted email header when the plugin was started with the
    last seen2020-06-01
    modified2020-06-02
    plugin id46246
    published2010-05-07
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/46246
    titleFreeBSD : spamass-milter -- remote command execution vulnerability (7132c842-58e2-11df-8d80-0015587e2cc1)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(46246);
      script_version("1.9");
      script_cvs_date("Date: 2019/08/02 13:32:40");
    
      script_cve_id("CVE-2010-1132");
    
      script_name(english:"FreeBSD : spamass-milter -- remote command execution vulnerability (7132c842-58e2-11df-8d80-0015587e2cc1)");
      script_summary(english:"Checks for updated package in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote FreeBSD host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The spamassassin milter plugin contains a vulnerability that can allow
    remote attackers to execute commands on affected systems.
    
    The vulnerability can be exploited trough a special-crafted email
    header when the plugin was started with the '-x' (expand) flag."
      );
      # http://archives.neohapsis.com/archives/fulldisclosure/2010-03/0139.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?c8cc9c7f"
      );
      # http://xforce.iss.net/xforce/xfdb/56732
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?d7f75c13"
      );
      # https://vuxml.freebsd.org/freebsd/7132c842-58e2-11df-8d80-0015587e2cc1.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?7ed771f7"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:spamass-milter");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/03/07");
      script_set_attribute(attribute:"patch_publication_date", value:"2010/05/06");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/05/07");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"spamass-milter<=0.3.1_8")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2021.NASL
    descriptionA missing input sanitization in spamass-milter, a milter used to filter mail through spamassassin, was discovered. This allows a remote attacker to inject and execute arbitrary shell commands.
    last seen2020-06-01
    modified2020-06-02
    plugin id45134
    published2010-03-24
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/45134
    titleDebian DSA-2021-1 : spamass-milter - missing input sanitization
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-2021. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(45134);
      script_version("1.10");
      script_cvs_date("Date: 2019/08/02 13:32:22");
    
      script_cve_id("CVE-2010-1132");
      script_xref(name:"DSA", value:"2021");
    
      script_name(english:"Debian DSA-2021-1 : spamass-milter - missing input sanitization");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A missing input sanitization in spamass-milter, a milter used to
    filter mail through spamassassin, was discovered. This allows a remote
    attacker to inject and execute arbitrary shell commands."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=573228"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2010/dsa-2021"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the spamass-milter package.
    
    For the stable distribution (lenny), this problem has been fixed in
    version 0.3.1-8+lenny1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:spamass-milter");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:5.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/03/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/03/24");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"5.0", prefix:"spamass-milter", reference:"0.3.1-8+lenny1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2010-5112.NASL
    descriptionThis update includes a fix for a problem where if the milter is running using the
    last seen2020-06-01
    modified2020-06-02
    plugin id47380
    published2010-07-01
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/47380
    titleFedora 13 : spamass-milter-0.3.1-18.fc13 (2010-5112)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2010-5112.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(47380);
      script_version("1.9");
      script_cvs_date("Date: 2019/08/02 13:32:32");
    
      script_cve_id("CVE-2010-1132");
      script_xref(name:"FEDORA", value:"2010-5112");
    
      script_name(english:"Fedora 13 : spamass-milter-0.3.1-18.fc13 (2010-5112)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update includes a fix for a problem where if the milter is
    running using the '-x' option to expand aliases before passing inbound
    mail through SpamAssassin, a malicious client using a
    carefully-crafted SMTP session could execute arbitrary code on the
    mail server. The fix avoids the use of a shell in the alias expansion
    and hence there is no longer a problem with having to sanitize input
    from the client. This problem has been assigned CVE-2010-1132, which
    is tracked upstream at https://savannah.nongnu.org/bugs/?29136 The
    update also contains improved Received-header-generation for message
    submission and a fix for a problem where the milter would erroneously
    log warnings about the mail server's configuration when the first
    message from a non-authenticated client passed through. As part of the
    fix for this issue, the required milter macro configuration for the
    mail server has changed slightly: see the README file included in the
    package for details.
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=572117"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2010-April/038777.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?4163abb7"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://savannah.nongnu.org/bugs/?29136"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected spamass-milter package."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:spamass-milter");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:13");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/03/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/07/01");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^13([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 13.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC13", reference:"spamass-milter-0.3.1-18.fc13")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "spamass-milter");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2010-5096.NASL
    descriptionThis update includes a fix for a problem where if the milter is running using the
    last seen2020-06-01
    modified2020-06-02
    plugin id47378
    published2010-07-01
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/47378
    titleFedora 12 : spamass-milter-0.3.1-18.fc12 (2010-5096)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2010-5176.NASL
    descriptionThis update includes a fix for a problem where if the milter is running using the
    last seen2020-06-01
    modified2020-06-02
    plugin id47381
    published2010-07-01
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/47381
    titleFedora 11 : spamass-milter-0.3.1-18.fc11 (2010-5176)
  • NASL familySMTP problems
    NASL idSPAMASS_MILTER.NASL
    descriptionThe remote mail server is affected by a command execution vulnerability. Specifically, the
    last seen2020-06-01
    modified2020-06-02
    plugin id45019
    published2010-03-09
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45019
    titleSpamAssassin Milter Plugin 'mlfi_envrcpt()' Remote Arbitrary Command Injection