CVE-2004-2771 Command injection in n/a
Remote attackers can execute arbitrary commands via shell metacharacters in email addresses processed by the mailx utility.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2004-2771?
CVE-2004-2771 is a high-severity command injection vulnerability in Oracle Linux, published on 24 Dec 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.
Weakness: CWE-20
Which versions are affected by CVE-2004-2771?
It affects 4 products.
Products include Bsd Mailx Project Bsd Mailx, Heirloom Mailx, Oracle Linux, Redhat Enterprise Linux.
How do I fix CVE-2004-2771?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2004-2771 being exploited?
There is no known exploitation of CVE-2004-2771 in the wild and no public exploit code.
Other vulnerabilities in Oracle Linux
Sources
Also known as AZL-36961, AZL-6676, AZL-7286, DEBIAN-CVE-2004-2771, GHSA-3f68-9fxg-g2j6, UBUNTU-CVE-2004-2771.