Description
The read_list_from_file function in vacation.pl for OpenWebmail before 2.32 20040629 allows remote attackers to execute arbitrary commands via shell metacharacters in a filename argument.
References
- open-webmail-vacation-program-execution(16549) vdb-entry
- 1010605 vdb-entry
- http://openwebmail.org/openwebmail/download/cert/advisories/SA-04:04.txt
- 10637 vdb-entry
- 12017 third-party-advisory
- 7474 vdb-entry