USN-2455-1: bsd-mailx vulnerability
Description
It was discovered that bsd-mailx contained a feature that allowedsyntactically valid email addresses to be treated as shell commands. Aremote attacker could possibly use this issue with a valid email address toexecute arbitrary commands. This functionality has now been disabled by default, and can be re-enabledwith the "expandaddr" configuration option. This update alone does notremove all possibilities of command execution. In environments wherescripts use mailx to process arbitrary email addresses, it is recommendedto modify them to use a "--" separator before the address to properlyhandle those that begin with "-". In addition, specifying sendmail optionsafter the "--" separator is no longer supported, existing scripts may needto be modified to use the "-a" option instead. The problem can be corrected by updating your system to the following package version: To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades. In general, a standard system update will make all the necessary changes. CVE-2014-7844
Solution(s)
- ubuntu-upgrade-bsd-mailx
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center