NewsSANS ISC Diary

    The Classics Return: Vulnerable E-Mail Scripts, (Wed, Nov 4th)

    Share
    One of the early web application vulnerabilities I remember was CVE-2000-0411 [CVE]. This was a simple vulnerability in a CGI-bin script used to send e-mail. The vulnerability was pretty straightforward: Adding additional parameters to the URL leaked environment variables. Other vulnerabilities allowed setting the "To" address and were heavily abused by spammers. And if parameters were passed directly to the sendmail binary, similar vulnerabilities could allow arbitrary code execution.

    Linked advisories

    Affected vendors and products

    More on Classics

    Other advisories

    Source: https://isc.sans.edu/diary/rss/33488

    ID