CVE-2010-1132 Command injection in n/a
Remote attackers can execute arbitrary system commands via shell metacharacters in the RCPT TO field when the expand option is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-1132?
CVE-2010-1132 is a critical command injection vulnerability in n/a, published on 26 Mar 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The mlfi_envrcpt function in spamass-milter.cpp in SpamAssassin Milter Plugin 0.3.1, when using the expand option, allows remote attackers to execute arbitrary system commands via shell metacharacters in the RCPT TO field of an email message.
Weakness: CWE-78
Which versions are affected by CVE-2010-1132?
It affects 1 product.
Products include Georg Greve Spamassassin Milter Plugin.
How do I fix CVE-2010-1132?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2010-1132 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-1132 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as DEBIAN-CVE-2010-1132, DSA-2021-1, DSA-2021-2, GHSA-mm8j-8fj4-43p5.