Detections
Analytics

qpopper < 3.0.1b2 EIUDL Arbitrary Command Execution

medium Nessus Network Monitor Plugin ID 1784

Synopsis

An attacker can gain an unprivileged shell on the remote system.

Description

The system is using qpopper 2.53 (or newer in the 2.5x series). There is a problem in this server that allows users who have a pop account to gain a shell with the gid 'mail' by sending to themselves a specially crafted mail.

Solution

Upgrade to version 3.0.1b2 or higher.

Plugin Details

Severity: Medium

ID: 1784

Family: POP Server

Published: 8/20/2004

Updated: 3/6/2019

Nessus ID: 10423

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 6.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:H/RL:W/RC:X

Vulnerability Information

CPE: cpe:/a:qualcomm:qpopper

Reference Information

CVE: CVE-2000-0320

BID: 1133