Two vulnerabilities affecting the mailx utility systems Unixhave been patched by Debian and Red Hat Linux distributions. One of the vulnerabilities was patched in the BSD mailx in Debian ten years ago, but it still existed in Heirloom mailx .
Security updates for both operating systems state that an attacker could use mailx to execute arbitrary commands on the system via properly crafted malicious email addresses.
Mailx , also known as Mail User Agent, is a utility for sending and receiving messages, used by many email programs and present in many Linux distributions .
One of the issues was discovered in 2004
The security issue is that email addresses are not parsedcorrectly, and so it is possible for mailx to execute shell commands via shell meta-characters (CVE-2004-2771) as well as offer the ability to execute direct commands (CVE-2014-7844).
CVE -2004-2771 was published in October 2004 by Seungbeom Kim and was identified as a security issue. At that time, Robert Luberda, the Debian mailx maintainer , released a patch for the BSD implementation .
The current security updates for Debian and Red Hat Enterprise Linux (versions 6 and 7) distributions are designed to fix security vulnerabilities for BSD-mailx and Heirloom mailx.
