admin/GobyVuls
1
0
Fork 0
mirror of https://github.com/gobysec/GobyVuls.git synced 2025-05-06 10:41:40 +00:00
Code Issues Packages Projects Releases Wiki Activity
GobyVuls/OpenSMTPD/CVE-2020-7247
History
tardc 40e8881c1c Add CVE-2020-7247.gif
2020-06-12 20:29:33 +08:00
..
CVE-2020-7247.gif
Add CVE-2020-7247.gif
2020-06-12 20:29:33 +08:00
README.md
Add CVE-2020-7247
2020-06-10 14:10:30 +08:00

README.md

CVE-2020-7247 OpenSMTPD Remote Code Execution Vulnerability

smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.

FOFA query rule: banner="opensmtpd" && protocol=="smtp"

Demo