Executive brief
Majordomo, a widely used mailing list management system, contains a flaw that allows remote attackers to run unauthorized commands on the server. By sending a specially crafted email with malicious characters in the 'Reply-To' header, an attacker can gain control over the mailing list server. This could lead to the theft of subscriber data, disruption of email services, or further attacks on the internal network.
Technical details
A remote command execution vulnerability exists in Majordomo versions 1.94.3 and earlier. The vulnerability is triggered when the 'advertise' or 'noadvertise' directives are enabled in the configuration file. The software fails to properly sanitize the 'Reply-To' header in incoming emails before passing it to a shell for processing. An unauthenticated remote attacker can exploit this by sending an email containing shell metacharacters (e.g., semicolons or backticks) in the Reply-To field, leading to arbitrary command execution with the privileges of the Majordomo process. Users should upgrade to a patched version or disable the affected directives.
Affected products
- Great Circle Associates Majordomo 1.94.3 and earlier
Timeline
- 1997-08-24: disclosed: Initial public disclosure of the vulnerability.
- 1997-08-24: advisory: NVD published date.