CVE-2007-2173: Critical severity Gentoo Linux vulnerability
Published Apr 24, 2007
·Updated
Eval injection vulnerability in (1) courier-imapd.indirect and (2) courier-pop3d.indirect in Courier-IMAP before 4.0.6-r2, and 4.1.x before 4.1.2-r1, on Gentoo Linux allows remote attackers to execute arbitrary commands via the XMAILDIR variable, related to the LOGINRUN variable.
Affected Software
9 affected components
Gentoo Linux
Double Precision Incorporated Courier-imap=4.0.0
Double Precision Incorporated Courier-imap=4.0.1
Double Precision Incorporated Courier-imap=4.0.2
Double Precision Incorporated Courier-imap=4.0.3
Double Precision Incorporated Courier-imap=4.0.4
Double Precision Incorporated Courier-imap=4.0.5
Double Precision Incorporated Courier-imap=4.1.0
Double Precision Incorporated Courier-imap=4.1.1
Remediation
Patch Available
Event History
Apr 24, 2007
CVE Published
04:19 PM
Data Sourced
04:19 PM
DescriptionWeaknessAffected Software
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-2173?
CVE-2007-2173 is considered a high severity vulnerability as it allows remote attackers to execute arbitrary commands.
2
How do I fix CVE-2007-2173?
To fix CVE-2007-2173, upgrade Courier-IMAP to version 4.0.6-r2 or 4.1.2-r1 or later.
3
Which versions are affected by CVE-2007-2173?
CVE-2007-2173 affects Courier-IMAP versions 4.0.0 to 4.0.5 and 4.1.0 to 4.1.1.
4
What type of vulnerability is CVE-2007-2173?
CVE-2007-2173 is an evaluation injection vulnerability.
5
Who is affected by CVE-2007-2173?
Users running vulnerable versions of Courier-IMAP on Gentoo Linux are affected by CVE-2007-2173.