Sploitus

Exploit for ClamAV milter popen command injection

saint Β· 2007-09-06

Exploit Code

MARKDOWN29 lines
## https://sploitus.com/exploit?id=SAINT:61A42486FDC3E09655A7B9A3336F7AC7
Added: 09/06/2007  
CVE: [CVE-2007-4560](<https://vulners.com/cve/CVE-2007-4560>)  
BID: [25439](<http://www.securityfocus.com/bid/25439>)  
OSVDB: [36909](<http://www.osvdb.org/36909>)  


### Background

[ClamAV](<http://www.clamav.net/>) is an open-source anti-virus toolkit. [clamav-milter](<http://www.clamav.org/download/third-party-tools/3rdparty-mta/>) is a derivative of ClamAV for e-mail servers running Sendmail. 

### Problem

An insecure call to the popen function in clamav-milter, when running in black hole mode, allows an attacker to inject shell commands into the recipient field. 

### Resolution

[Upgrade](<http://www.clamav.org/download>) to ClamAV 0.91.2 or higher. 

### References

<http://www.securityfocus.com/archive/1/477723>  


### Limitations

Exploit works on ClamAV 0.91.1. 

In order for the exploit to succeed, Sendmail must be configured to use clamav-milter, clamav-milter must be running in black hole mode, and the following utilities must be present on the target system: nc, nc6 (if using IPv6), mkfifo, sh.