vulnwire
7.6high

CVE-2007-4560in critical feed4 exploits

clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacha…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
7.6
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
83.5%
percentile 100%
Public exploits
4
Metasploit · Exploit-DB

clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the "recipient field of sendmail."

Exploit prediction (EPSS)

83.54% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • Metasploit exploit/unix/smtp/clamav_milter_blackhole ClamAV Milter Blackhole-Mode Remote Code Execution · metasploit exploit, excellent rank · 2007-08-24
  • EDB-9913 ClamAV Milter 0.92.2 - Blackhole-Mode (Sendmail) Code Execution (Metasploit) · remote · 2007-08-24
  • EDB-4761 Sendmail with clamav-milter < 0.91.2 - Remote Command Execution · remote · 2007-12-21
  • EDB-16924 ClamAV Milter - Blackhole-Mode Remote Code Execution (Metasploit) · remote · 2010-10-09

CVSS scores

Assigned byVersionScoreVector
NVD2.07.6AV:N/AC:H/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

  • security.gentoo.org /glsa/glsa-200709-14.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securityreason.com /securityalert/3063 · third-party-advisory, x_refsource_SREASON, x_transferred
  • secunia.com /advisories/26822 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/26916 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/477723/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/26683 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • nruns.com /security_advisory_clamav_remote_code_exection.php · x_refsource_MISC, x_transferred
  • redhat.com /archives/fedora-package-announce/2007-September/msg00104.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • debian.org /security/2007/dsa-1366 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • vupen.com /english/advisories/2008/0924/references · vdb-entry, x_refsource_VUPEN, x_transferred
  • trustix.org /errata/2007/0026/ · vendor-advisory, x_refsource_TRUSTIX, x_transferred
  • secunia.com /advisories/29420 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • novell.com /linux/security/advisories/2007_18_sr.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.apple.com /archives/security-announce/2008/Mar/msg00001.html · vendor-advisory, x_refsource_APPLE, x_transferred
  • secunia.com /advisories/26751 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securitytracker.com /id?1018610 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • secunia.com /advisories/26654 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • docs.info.apple.com /article.html?artnum=307562 · x_refsource_CONFIRM, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2007:172 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • secunia.com /advisories/26674 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/25439 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.