Command injection in BSD mailx and Heirloom mailx - CVE-2014-7844

Vulnerability identifier: #VU11823

CSH Severity: Low

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-7844

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The weakness exists due to improper handling of the parsing of email addresses. A remote attacker can execute arbitrary commands through the direct command execution functionality.

BSD mailx
Heirloom mailx
Debian Linux
Gentoo Linux
Amazon Linux AMI
Fedora
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux EUS Compute Node
Ubuntu
Slackware Linux
heirloom-mailx (Alpine package)
bsd-mailx
nail
mailx

Update BSD mailx to version 8.1.2.20160123.

heirloom-mailx (Alpine package) - update to 12.5-r0
bsd-mailx - update to 8.1.2-5.el6
nail - update to 12.4-1.el5
mailx - update to 12.5-14.fc21

• http://seclists.org/oss-sec/2014/q4/1066

• Ubuntu update for bsd-mailx
• Debian update for bsd-mailx
• Debian update for heirloom-mailx
• Gentoo update for mailx
• Slackware Linux update for mailx
• Amazon Linux AMI update for mailx
• Red Hat update for mailx
• Command injection in heirloom-mailx (Alpine package)
• Fedora 21 update for mailx
• Fedora EPEL 5 update for nail
• Fedora EPEL 6 update for bsd-mailx