Debian Security Advisory
DSA-1204-1 ingo1 -- missing input sanitising
- Date Reported:
- 02 Nov 2006
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 396099.
In Mitre's CVE dictionary: CVE-2006-5449.
- More information:
It was discovered that the Ingo email filter rules manager performs insufficient escaping of user-provided data in created procmail rules files, which allows the execution of arbitrary shell commands.
For the stable distribution (sarge), this problem has been fixed in version 1.0.1-1sarge1.
For the unstable distribution (sid), this problem has been fixed in version 1.1.2-1.
We recommend that you upgrade your ingo1 package.
- Fixed in:
Debian GNU/Linux 3.1 (sarge)
- Architecture-independent component:
MD5 checksums of the listed files are available in the original advisory.