Description
Argument injection vulnerability in greylistclean.cron in sa-exim 4.2 allows remote attackers to delete arbitrary files via an email with a To field that contains a filename separated by whitespace, which is not quoted when greylistclean.cron provides the argument to the rm command.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://secunia.com/advisories/19225 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25286 ↗
- http://www.securityfocus.com/bid/17110 ↗
- http://marc.merlins.org/linux/exim/files/sa-exim-cvs/Changelog.html ↗
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=345071 ↗
- http://www.vupen.com/english/advisories/2006/0941 ↗