National Cyber Awareness System

Vulnerability Summary for CVE-2012-2140

Overview

The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://github.com/mikel/mail/commit/ac56f03bdfc30b379aeecd4ff317d08fdaa328c2

Type: Patch Information; Exploit

Hyperlink:https://github.com/mikel/mail/commit/ac56f03bdfc30b379aeecd4ff317d08fdaa328c2

External Source: CONFIRM

Name: https://github.com/mikel/mail/commit/39b590ddb08f90ddbe445837359a2c8843e533d0

Type: Patch Information; Exploit

Hyperlink:https://github.com/mikel/mail/commit/39b590ddb08f90ddbe445837359a2c8843e533d0

External Source: CONFIRM

Name: https://github.com/mikel/mail/blob/9beb079c70d236a5ad2e1ba95b2c977e55deb7af/CHANGELOG.rdoc

Hyperlink:https://github.com/mikel/mail/blob/9beb079c70d236a5ad2e1ba95b2c977e55deb7af/CHANGELOG.rdoc

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=816352

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=816352

External Source: MISC

Name: https://bugzilla.novell.com/show_bug.cgi?id=759092

Hyperlink:https://bugzilla.novell.com/show_bug.cgi?id=759092

External Source: MLIST

Name: [oss-security] 20120425 Re: CVE request: two flaws fixed in rubygem-mail 2.4.4

Hyperlink:http://www.openwall.com/lists/oss-security/2012/04/26/1

External Source: MLIST

Name: [oss-security] 20120425 CVE request: two flaws fixed in rubygem-mail 2.4.4

Hyperlink:http://www.openwall.com/lists/oss-security/2012/04/25/8

External Source: SECUNIA

Name: 48970

Type: Advisory

Hyperlink:http://secunia.com/advisories/48970

External Source: FEDORA

Name: FEDORA-2012-7619

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html

External Source: FEDORA

Name: FEDORA-2012-7535

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html

External Source: FEDORA

Name: FEDORA-2012-7692

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html