Signature Detail

SMTP: RCPT Command Injection

This signature detects attempts to exploit a known vulnerability against multiples SMTP solutions including Clam-AV and SpamAssassin. A successful attack can lead to arbitrary code execution.

Extended Description

ClamAV is prone to a remote code-execution vulnerability because the application fails to properly sanitize user-supplied data. An attacker can exploit this issue to execute arbitrary code with superuser privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. Versions prior to ClamAV 0.91.2 are vulnerable.

Affected Products

• Apple Mac OS X Server 10.5
• Apple Mac OS X Server 10.5.1
• Apple Mac OS X Server 10.5.2
• Clam Anti-Virus ClamAV 0.51.0
• Clam Anti-Virus ClamAV 0.52.0
• Clam Anti-Virus ClamAV 0.53.0
• Clam Anti-Virus ClamAV 0.54.0
• Clam Anti-Virus ClamAV 0.60.0
• Clam Anti-Virus ClamAV 0.65.0
• Clam Anti-Virus ClamAV 0.67.0
• Clam Anti-Virus ClamAV 0.68.0
• Clam Anti-Virus ClamAV 0.68.0 -1
• Clam Anti-Virus ClamAV 0.70.0
• Clam Anti-Virus ClamAV 0.75.1
• Clam Anti-Virus ClamAV 0.80.0
• Clam Anti-Virus ClamAV 0.80.0 Rc1
• Clam Anti-Virus ClamAV 0.80.0 Rc2
• Clam Anti-Virus ClamAV 0.80.0 Rc3
• Clam Anti-Virus ClamAV 0.80.0 Rc4
• Clam Anti-Virus ClamAV 0.81.0
• Clam Anti-Virus ClamAV 0.82.0
• Clam Anti-Virus ClamAV 0.83.0
• Clam Anti-Virus ClamAV 0.84.0
• Clam Anti-Virus ClamAV 0.84.0 Rc1
• Clam Anti-Virus ClamAV 0.84.0 Rc2
• Clam Anti-Virus ClamAV 0.85.0
• Clam Anti-Virus ClamAV 0.85.1
• Clam Anti-Virus ClamAV 0.86.0
• Clam Anti-Virus ClamAV 0.86.0 .1
• Clam Anti-Virus ClamAV 0.86.2
• Clam Anti-Virus ClamAV 0.87.0
• Clam Anti-Virus ClamAV 0.87.0 -1
• Clam Anti-Virus ClamAV 0.87.1
• Clam Anti-Virus ClamAV 0.88.0
• Clam Anti-Virus ClamAV 0.88.1
• Clam Anti-Virus ClamAV 0.88.2
• Clam Anti-Virus ClamAV 0.88.3
• Clam Anti-Virus ClamAV 0.88.4
• Clam Anti-Virus ClamAV 0.88.5
• Clam Anti-Virus ClamAV 0.88.6
• Clam Anti-Virus ClamAV 0.90.0
• Clam Anti-Virus ClamAV 0.90.1
• Clam Anti-Virus ClamAV 0.90.2
• Clam Anti-Virus ClamAV 0.90.3
• Clam Anti-Virus ClamAV 0.91
• Clam Anti-Virus ClamAV 0.91.1
• Debian Linux 4.0
• Debian Linux 4.0 Alpha
• Debian Linux 4.0 Amd64
• Debian Linux 4.0 Arm
• Debian Linux 4.0 Hppa
• Debian Linux 4.0 Ia-32
• Debian Linux 4.0 Ia-64
• Debian Linux 4.0 M68k
• Debian Linux 4.0 Mips
• Debian Linux 4.0 Mipsel
• Debian Linux 4.0 Powerpc
• Debian Linux 4.0 S/390
• Debian Linux 4.0 Sparc
• Gentoo Linux
• Mandriva Corporate Server 3.0.0
• Mandriva Corporate Server 3.0.0 X86 64
• Mandriva Corporate Server 4.0
• Mandriva Corporate Server 4.0.0 X86 64
• Mandriva Linux Mandrake 2007.0
• Mandriva Linux Mandrake 2007.0 X86 64
• Mandriva Linux Mandrake 2007.1
• Mandriva Linux Mandrake 2007.1 X86 64
• Red Hat Fedora Core7
• SuSE Linux 10.0 Ppc
• SuSE Linux 10.0 X86
• SuSE Linux 10.0 X86-64
• SuSE Linux 10.1 Ppc
• SuSE Linux 10.1 X86
• SuSE Linux 10.1 X86-64
• SuSE Linux Desktop 10
• SuSE Linux Desktop 1.0.0
• SuSE Linux Enterprise Server for S/390 9.0.0
• SuSE Linux Enterprise Server for S/390
• SuSE Linux Office Server
• SuSE Linux Openexchange Server
• SuSE Linux Personal 10.0.0 OSS
• SuSE Linux Personal 10.1
• SuSE Linux Personal 10.2
• SuSE Linux Personal 10.2 X86 64
• SuSE Linux Professional 10.0.0
• SuSE Linux Professional 10.0.0 OSS
• SuSE Linux Professional 10.1
• SuSE Linux Professional 10.2
• SuSE Linux Professional 10.2 X86 64
• SuSE Novell Linux Desktop 9.0.0
• SuSE Novell Linux POS 9
• SuSE openSUSE 10.2
• SuSE SUSE Linux Enterprise Desktop 10
• SuSE SUSE Linux Enterprise Desktop 10 SP1
• SuSE SUSE Linux Enterprise SDK 10
• SuSE SUSE Linux Enterprise SDK 10.SP1
• SuSE SUSE Linux Enterprise Server 10
• SuSE SUSE Linux Enterprise Server 10 SP1
• SuSE SUSE Linux Enterprise Server 8
• SuSE SUSE Linux Enterprise Server 9
• SuSE SUSE Linux Enterprise Server 9 SP3
• SuSE SuSE Linux Openexchange Server 4.0.0
• SuSE SUSE LINUX Retail Solution 8.0.0
• SuSE SuSE Linux School Server for i386
• SuSE SuSE Linux Standard Server 8.0.0
• SuSE UnitedLinux 1.0.0
• Trustix Operating System Enterprise Server 2.0
• Trustix Secure Linux 2.2.0
• Trustix Secure Linux 3.0.0
• Trustix Secure Linux 3.0.5

References

• BugTraq: 25439
• CVE: CVE-2007-4560
• URL: http://www.nruns.com/security_advisory_clamav_remote_code_exection.php
• URL: http://sourceforge.net/project/shownotes.php?release_id=533658&group_id=86638