Vulnerability Description
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openbsd | Opensmtpd | 6.6 |
| Debian | Debian Linux | 9.0 |
| Fedoraproject | Fedora | 32 |
| Canonical | Ubuntu Linux | 18.04 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-EscalatiExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/156145/OpenSMTPD-6.6.2-Remote-Code-ExecutioExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/156249/OpenSMTPD-MAIL-FROM-Remote-Code-ExecExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/156295/OpenSMTPD-6.6.1-Local-Privilege-EscaExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/162093/OpenBSD-OpenSMTPD-6.6-Remote-Code-ExBroken LinkThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2020/Jan/49ExploitMailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2020/01/28/3ExploitMailing ListThird Party Advisory
- https://github.com/openbsd/src/commit/9dcfda045474d8903224d175907bfc29761dcb45Patch
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproMailing ListThird Party Advisory
- https://seclists.org/bugtraq/2020/Jan/51Mailing ListThird Party Advisory
- https://usn.ubuntu.com/4268-1/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4611Mailing ListThird Party Advisory
- https://www.kb.cert.org/vuls/id/390745Third Party AdvisoryUS Government Resource
- https://www.openbsd.org/security.htmlPatchVendor Advisory
- http://packetstormsecurity.com/files/156137/OpenBSD-OpenSMTPD-Privilege-EscalatiExploitThird Party AdvisoryVDB Entry
FAQ
What is CVE-2020-7247?
CVE-2020-7247 is a vulnerability with a CVSS score of 9.8 (CRITICAL). smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated b...
How severe is CVE-2020-7247?
CVE-2020-7247 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-7247?
Check the references section above for vendor advisories and patch information. Affected products include: Openbsd Opensmtpd, Debian Debian Linux, Fedoraproject Fedora, Canonical Ubuntu Linux.