National Cyber-Alert System

Vulnerability Summary for CVE-2007-4560

Overview

clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the "recipient field of sendmail."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 25439

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/25439

External Source: MISC

Name: http://www.nruns.com/security_advisory_clamav_remote_code_exection.php

Type: Patch Information

Hyperlink:http://www.nruns.com/security_advisory_clamav_remote_code_exection.php

External Source: FEDORA

Name: FEDORA-2007-2050

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00104.html

External Source: TRUSTIX

Name: 2007-0026

Hyperlink:http://www.trustix.org/errata/2007/0026/

External Source: SECTRACK

Name: 1018610

Hyperlink:http://www.securitytracker.com/id?1018610

External Source: BUGTRAQ

Name: 20070824 n.runs-SA-2007.025 - ClamAV Remote Code Execution Advisory

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/477723/100/0/threaded

External Source: SUSE

Name: SUSE-SR:2007:018

Hyperlink:http://www.novell.com/linux/security/advisories/2007_18_sr.html

External Source: MANDRIVA

Name: MDKSA-2007:172

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2007:172

External Source: DEBIAN

Name: DSA-1366

Hyperlink:http://www.debian.org/security/2007/dsa-1366

External Source: SREASON

Name: 3063

Hyperlink:http://securityreason.com/securityalert/3063

External Source: GENTOO

Name: GLSA-200709-14

Hyperlink:http://security.gentoo.org/glsa/glsa-200709-14.xml

External Source: SECUNIA

Name: 26916

Type: Advisory

Hyperlink:http://secunia.com/advisories/26916

External Source: SECUNIA

Name: 26822

Type: Advisory

Hyperlink:http://secunia.com/advisories/26822

External Source: SECUNIA

Name: 26751

Type: Advisory

Hyperlink:http://secunia.com/advisories/26751

External Source: SECUNIA

Name: 26683

Type: Advisory

Hyperlink:http://secunia.com/advisories/26683

External Source: SECUNIA

Name: 26674

Type: Advisory

Hyperlink:http://secunia.com/advisories/26674

External Source: SECUNIA

Name: 26654

Type: Advisory

Hyperlink:http://secunia.com/advisories/26654

External Source: VUPEN

Name: ADV-2008-0924

Hyperlink:http://www.frsirt.com/english/advisories/2008/0924/references

External Source: SECUNIA

Name: 29420

Hyperlink:http://secunia.com/advisories/29420

External Source: APPLE

Name: APPLE-SA-2008-03-18

Hyperlink:http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=307562

Hyperlink:http://docs.info.apple.com/article.html?artnum=307562