Description
Exim 3.22 and earlier, in some configurations, does not properly verify the local part of an address when redirecting the address to a pipe, which could allow remote attackers to execute arbitrary commands via shell metacharacters.
References
- 3728 vdb-entry
- exim-pipe-hostname-commands(7738) vdb-entry
- DSA-097 vendor-advisory
- 20011219 [ph10@cus.cam.ac.uk: [Exim] Potential security problem] mailing-list
- VU#283723 third-party-advisory
- RHSA-2001:176 vendor-advisory