CVE

Id
3177  
CVE No.
CVE-2001-0357  
Status
Candidate  
Description
FormMail.pl in FormMail 1.6 and earlier allows a remote attacker to send anonymous email (spam) by modifying the recipient and message parameters.  
Phase
Modified (20060526)  
Votes
ACCEPT(2) Baker, Frech | NOOP(6) Bishop, Christey, Cole, Foat, Wall, Ziese | REVIEWING(1) Williams  
Comments
Baker> http://www.securityfocus.com/archive/1/168177 | http://www.securityfocus.com/archive/1/168292 | http://www.securityfocus.com/archive/1/168366 | http://www.securityfocus.com/archive/1/168345 | http://www.securityfocus.com/archive/1/168302 | http://www.securityfocus.com/archive/1/168360 | http://www.securityfocus.com/archive/1/168633 | | I think from the discussion on the Bugtraq list, there is sufficient verfication that this | is a real problem, and well-known. There are a couple of work arounds | described in the posts, so this should be accepted. | Christey> Fix typo: "paramaters" | Christey> Fix typo: "paramater" | Christey> The following references discuss this problem and/or later | variants of it, up to version 1.9. | MISC:http://www.softwolves.pp.se/misc/formmail_hall_of_shame | MISC:http://www.monkeys.com/anti-spam/formmail-advisory.pdf | MISC:http://www.scriptarchive.com/readme/formmail.html  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
13286 3177 CVE-2001-0357 BUGTRAQ:20010310 CORRECTION to CODE: FormMail.pl can be used to send anonymous email  View
13287 3177 CVE-2001-0357 URL:http://marc.info/?l=bugtraq&m=98433523520344&w=2  View
13288 3177 CVE-2001-0357 XF:formmail-anonymous-flooding(6242)  View

Related JVN