CVE-2014-7844 – mailx: command execution flaw

https://notcve.org/view.php?id=CVE-2014-7844

BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address. BSD mailx versión 8.1.2 y anteriores, permiten a atacantes remotos ejecutar comandos arbitrarios por medio de una dirección de correo electrónico diseñada. A flaw was found in the way mailx handled the parsing of email addresses. A syntactically valid email address could allow a local attacker to cause mailx to execute arbitrary shell commands through shell meta-characters (CVE-2004-2771) and the direct command execution functionality (CVE-2014-7844). • http://linux.oracle.com/errata/ELSA-2014-1999.html http://rhn.redhat.com/errata/RHSA-2014-1999.html http://seclists.org/oss-sec/2014/q4/1066 http://www.debian.org/security/2014/dsa-3104 http://www.debian.org/security/2014/dsa-3105 https://access.redhat.com/security/cve/CVE-2014-7844 https://bugzilla.redhat.com/show_bug.cgi?id=1162783 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •