blob: 295933cb4b07e52837f455233be8399505bca91b [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200611-22">
<title>Ingo H3: Folder name shell command injection</title>
Ingo H3 is vulnerable to arbitrary shell command execution when handling
procmail rules.
<product type="ebuild">horde-ingo</product>
<announced>November 27, 2006</announced>
<revised>November 27, 2006: 01</revised>
<package name="www-apps/horde-ingo" auto="yes" arch="*">
<unaffected range="ge">1.1.2</unaffected>
<vulnerable range="lt">1.1.2</vulnerable>
Ingo H3 is a generic frontend for editing Sieve, procmail, maildrop and
IMAP filter rules.
Ingo H3 fails to properly escape shell metacharacters in procmail
<impact type="normal">
A remote authenticated attacker could craft a malicious rule which
could lead to the execution of arbitrary shell commands on the server.
Don't use procmail with Ingo H3.
All Ingo H3 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=www-apps/horde-ingo-1.1.2&quot;</code>
<uri link="">CVE-2006-5449</uri>
<metadata tag="requester" timestamp="Tue, 21 Nov 2006 06:42:39 +0000">
<metadata tag="submitter" timestamp="Fri, 24 Nov 2006 19:04:29 +0000">
<metadata tag="bugReady" timestamp="Fri, 24 Nov 2006 19:46:46 +0000">