up vote 0 down vote favorite
share [g+] share [fb]

What's going on here??

sendmail cat/etc/passwd
sendmail cat\etc\passwd
sendmail xxxcat/etc/passwd

Why in the world does this actually execute the cat command? This works at least on Fedora Core 4 O/S (yes, it's old, but still...) with Postfix.

Is this a known (and fixed) bug?

link|improve this question
feedback

1 Answer

up vote 2 down vote accepted

I tested Postfix 2.7.1-1 (Debian) and none of those work as you described. cat is not executed. (And to be honest, I can't imagine any possible reason why would sendmail execute an arbitrary part of its argument just because it happens to say "cat".)

Sure, if you strace the sendmail process, you might see the file /etc/passwd being open()ed, but that's completely normal: sendmail is querying the real name of your account, in order to fill the From: header correctly.

But strace does not show any calls to exec*(), except for the one that launches sendmail itself.

If you still believe this is a bug,

  • try a completely unrelated file instead:

    sendmail cat/etc/fstab

    Here fstab is something that normally would never be read.

  • make sure sendmail is not a shell alias or function:

    $ type sendmail
sendmail is /usr/sbin/sendmail

  • And update Postfix.

    (yes, it's old, but still...)

    Never complain about bugs in old software versions unless you have confirmed that they are present in the absolutely latest version too.

link|improve this answer
Thanks so much for the response. It turns out in my testing for exploits in another software package, I inadvertently got the other package to actually cat the passwd file into (overwriting) the sendmail binary. So now when I run the sendmail binary, it is just trying to execute the copy of the /etc/passwd file. So this was a slight misunderstanding on my part. My apologies, and thank you for the very nice and helpful answer. – user50328 Sep 24 '10 at 18:55
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.