What's going on here??

sendmail cat/etc/passwd
sendmail cat\etc\passwd
sendmail xxxcat/etc/passwd

Why in the world does this actually execute the cat command? This works at least on Fedora Core 4 O/S (yes, it's old, but still...) with Postfix.

Is this a known (and fixed) bug?


I tested Postfix 2.7.1-1 (Debian) and none of those work as you described. cat is not executed. (And to be honest, I can't imagine any possible reason why would sendmail execute an arbitrary part of its argument just because it happens to say "cat".)

Sure, if you strace the sendmail process, you might see the file /etc/passwd being open()ed, but that's completely normal: sendmail is querying the real name of your account, in order to fill the From: header correctly.

But strace does not show any calls to exec*(), except for the one that launches sendmail itself.

If you still believe this is a bug,

  • try a completely unrelated file instead:

    sendmail cat/etc/fstab

    Here fstab is something that normally would never be read.

  • make sure sendmail is not a shell alias or function:

    $ type sendmail
    sendmail is /usr/sbin/sendmail
  • And update Postfix.

    (yes, it's old, but still...)

    Never complain about bugs in old software versions unless you have confirmed that they are present in the absolutely latest version too.

  • Thanks so much for the response. It turns out in my testing for exploits in another software package, I inadvertently got the other package to actually cat the passwd file into (overwriting) the sendmail binary. So now when I run the sendmail binary, it is just trying to execute the copy of the /etc/passwd file. So this was a slight misunderstanding on my part. My apologies, and thank you for the very nice and helpful answer. – user50328 Sep 24 '10 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.