Ubuntu 14.04 LTS: 2455-1 Moderate: bsd-mailx Command Execution Risk

ubuntu

January 7, 2015

bsd-mailx could be made to run programs if it parsed a specially crafted email address.

Summary

bsd-mailx could be made to run programs if it parsed a specially crafted

email address.

Software Description:

- bsd-mailx: simple mail user agent

Details:

It was discovered that bsd-mailx contained a feature that allowed

syntactically valid email addresses to be treated as shell commands. A

remote attacker could possibly use this issue with a valid email address to

execute arbitrary commands.

This functionality has now been disabled by default, and can be re-enabled

with the "expandaddr" configuration option. This update alone does not

remove all possibilities of command execution. In environments where

scripts use mailx to process arbitrary email addresses, it is recommended

to modify them to use a "--" separator before the address to properly

handle those that begin with "-".

Topics Covered

security advisory moderate update command execution Ubuntu shell command bsd-mailx

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  bsd-mailx                       8.1.2-0.20131005cvs-1ubuntu0.14.10.1

Ubuntu 14.04 LTS:
  bsd-mailx                       8.1.2-0.20131005cvs-1ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  bsd-mailx                       8.1.2-0.20111106cvs-1ubuntu0.1

Ubuntu 10.04 LTS:
  bsd-mailx                       8.1.2-0.20090911cvs-2ubuntu1.1

In general, a standard system update will make all the necessary changes.