NVD

Id
48666  
Name
CVE-2009-1381  
Description
The map_yp_alias function in functions/imap_general.php in SquirrelMail before 1.4.19-1 on Debian GNU/Linux, and possibly other operating systems and versions, allows remote attackers to execute arbitrary commands via shell metacharacters in a username string that is used by the ypmatch program. NOTE: this issue exists because of an incomplete fix for CVE-2009-1579.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-05-22  
Modified Date
2009-06-09  
Seq
2009-1381  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
245749 48666 CVE-2009-1381 http://release.debian.org/proposed-updates/stable_diffs/squirrelmail_1.4.15-4+lenny2.debdiff  View
245750 48666 CVE-2009-1381 DSA-1802  View
245751 48666 CVE-2009-1381 MDVSA-2009:122  View
245752 48666 CVE-2009-1381 20090521 [SECURITY] [DSA 1802-2] New squirrelmail packages correct incomplete fix  View
245753 48666 CVE-2009-1381 FEDORA-2009-5471  View
245754 48666 CVE-2009-1381 FEDORA-2009-5350  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40550 JVNDB-2009-001556 SquirrelMail における任意のコマンドを実行される脆弱性 Debian GNU/Linux 上で稼働している SquirrelMail の functions/mime.php における map_yp_alias 関数には、ypmatch プログラムに使用されたユーザ名文字列内のシェルメタキャラクタの処理に不備があるため、任意のコマンドを実行される脆弱性が存在します。 CVE-2009-1381 38812 CVE-2009-1381 48666 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001556.html 2009-05-10 2009-07-02 View