CVE-2002-1165
published 2002-10-11CVE-2002-1165: Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass…
PriorityP419medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EXPLOIT
EPSS
1.10%
61.9th percentile
Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after (1) "||" sequences or (2) "/" characters, which are not properly filtered or verified.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | sendmail | < sendmail 8.12.3-5 (bookworm) | sendmail 8.12.3-5 (bookworm) |
| netbsd | netbsd | — | — |
| netbsd | netbsd | — | — |
| netbsd | netbsd | — | — |
| netbsd | netbsd | — | — |
| netbsd | netbsd | — | — |
| sendmail | sendmail | — | — |
| sendmail | sendmail | — | — |
| sendmail | sendmail | — | — |
| sendmail | sendmail | — | — |
| sendmail | sendmail | — | — |
| sendmail | sendmail | — | — |
| sendmail | sendmail | — | — |
| sendmail | sendmail | >= 0 < 8.12.3-5 | 8.12.3-5 |
| sendmail | sendmail | >= 0 < 8.12.3-5 | 8.12.3-5 |
| sendmail | sendmail | >= 0 < 8.12.3-5 | 8.12.3-5 |
| sendmail | sendmail | >= 0 < 8.12.3-5 | 8.12.3-5 |
CVSS provenance
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv4.6MEDIUM
vendor_debian4.6MEDIUM
vendor_redhat4.6MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-48jx-mwjr-89wq: Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8
ghsa_unreviewed·2022-05-03
CVE-2002-1165 [MEDIUM] GHSA-48jx-mwjr-89wq: Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8
Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after (1) "||" sequences or (2) "/" characters, which are not properly filtered or verified.
OSV
CVE-2002-1165: Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8
osv·2002-10-11·CVSS 4.6
CVE-2002-1165 [MEDIUM] CVE-2002-1165: Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8
Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after (1) "||" sequences or (2) "/" characters, which are not properly filtered or verified.
Red Hat
security flaw
vendor_redhat·2002-10-01·CVSS 4.6
CVE-2002-1165 [MEDIUM] security flaw
security flaw
Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after (1) "||" sequences or (2) "/" characters, which are not properly filtered or verified.
Debian
CVE-2002-1165: sendmail - Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, an...
vendor_debian·2002·CVSS 4.6
CVE-2002-1165 [MEDIUM] CVE-2002-1165: sendmail - Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, an...
Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after (1) "||" sequences or (2) "/" characters, which are not properly filtered or verified.
Scope: local
bookworm: resolved (fixed in 8.12.3-5)
bullseye: resolved (fixed in 8.12.3-5)
forky: resolved (fixed in 8.12.3-5)
sid: resolved (fixed in 8.12.3-5)
trixie: resolved (fixed in 8.12.3-5)
No detection rules found.
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-023.txt.aschttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000532http://marc.info/?l=bugtraq&m=103350914307274&w=2http://secunia.com/advisories/7826http://www.iss.net/security_center/static/10232.phphttp://www.mandriva.com/security/advisories?name=MDKSA-2002:083http://www.redhat.com/support/errata/RHSA-2003-073.htmlhttp://www.securityfocus.com/bid/5845http://www.sendmail.org/smrsh.adv.txtftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-023.txt.aschttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000532http://marc.info/?l=bugtraq&m=103350914307274&w=2http://secunia.com/advisories/7826http://www.iss.net/security_center/static/10232.phphttp://www.mandriva.com/security/advisories?name=MDKSA-2002:083http://www.redhat.com/support/errata/RHSA-2003-073.htmlhttp://www.securityfocus.com/bid/5845http://www.sendmail.org/smrsh.adv.txt
2002-10-11
Published