Family: Gentoo Local Security Checks --> Category: infos
[GLSA-200611-22] Ingo H3: Folder name shell command injection Vulnerability Scan
Vulnerability Scan Summary
Ingo H3: Folder name shell command injection
Detailed Explanation for this Vulnerability Test
The remote host is affected by the vulnerability described in GLSA-200611-22
(Ingo H3: Folder name shell command injection)
Ingo H3 fails to properly escape shell metacharacters in procmail
A remote authenticated attacker could craft a malicious rule which
could lead to the execution of arbitrary shell commands on the server.
Don't use procmail with Ingo H3.
All Ingo H3 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/horde-ingo-1.1.2"
Threat Level: Medium
Click HERE for more information and discussions on this network vulnerability scan.