CVE-2002-1582

compose.cgi in Mailreader.com 2.3.30 and 2.3.31, when using Sendmail as the Mail Transfer Agent, allows remote attackers to execute arbitrary commands via shell metacharacters in the RealEmail configuration variable, which is used to call Sendmail in network.cgi.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.iss.net/security_center/static/10491.php	Patch Vendor Advisory
http://www.mailreader.com/download/ChangeLog	Vendor Advisory
http://www.securityfocus.com/archive/1/297428	Exploit Patch Vendor Advisory
http://www.securityfocus.com/bid/6058	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mailreader.com:mailreader.com:2.3.30:::::::*
	cpe:2.3:a:mailreader.com:mailreader.com:2.3.31:::::::*

History

No history.

Information

Published : 2004-12-06 05:00

Updated : 2008-09-05 20:30

NVD link : CVE-2002-1582

Mitre link : CVE-2002-1582

CVE.ORG link : CVE-2002-1582

JSON object : View

Products Affected

mailreader.com

mailreader.com

CWE

NVD-CWE-Other

{"id": "CVE-2002-1582", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2004-12-06T05:00:00.000", "references": [{"url": "http://www.iss.net/security_center/static/10491.php", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.mailreader.com/download/ChangeLog", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/297428", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/6058", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "compose.cgi in Mailreader.com 2.3.30 and 2.3.31, when using Sendmail as the Mail Transfer Agent, allows remote attackers to execute arbitrary commands via shell metacharacters in the RealEmail configuration variable, which is used to call Sendmail in network.cgi."}, {"lang": "es", "value": "compose.cgi en Mailreader.com 2.3.30 y 2.3.31, cuando se usa Sendmail como Agente de Transferencia de Correo (MTA), permite a atacantes remotos ejecutar c\u00f3digo arbitrario mediante metacaract\u00e9res de shell en la variable de configuraci\u00f3n RealMail"}], "lastModified": "2008-09-05T20:30:59.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mailreader.com:mailreader.com:2.3.30:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A37F7F2-C147-4D04-83D0-421EDB1EF343"}, {"criteria": "cpe:2.3:a:mailreader.com:mailreader.com:2.3.31:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19CC1D27-027D-4032-B9CC-CD41ED085FD0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}