Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.
Sign up to join this community
What's going on here??
sendmail cat/etc/passwd
sendmail cat\etc\passwd
sendmail xxxcat/etc/passwd
Why in the world does this actually execute the cat command? This works at least on Fedora Core 4 O/S (yes, it's old, but still...) with Postfix.
Is this a known (and fixed) bug?
I tested Postfix 2.7.1-1 (Debian) and none of those work as you described. cat is not executed. (And to be honest, I can't imagine any possible reason why would sendmail execute an arbitrary part of its argument just because it happens to say "cat".)
Sure, if you strace the sendmail process, you might see the file /etc/passwd being open()ed, but that's completely normal: sendmail is querying the real name of your account, in order to fill the From: header correctly.
But strace does not show any calls to exec*(), except for the one that launches sendmail itself.
If you still believe this is a bug,
try a completely unrelated file instead:
sendmail cat/etc/fstab
Here fstab is something that normally would never be read.
make sure sendmail is not a shell alias or function:
$ type sendmail
sendmail is /usr/sbin/sendmail
And update Postfix.
(yes, it's old, but still...)
Never complain about bugs in old software versions unless you have confirmed that they are present in the absolutely latest version too.
