Debian Security Advisory
DSA-1204-1 ingo1 -- missing input sanitising
- Date Reported:
- 02 Nov 2006
- Affected Packages:
- ingo1
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 396099.
In Mitre's CVE dictionary: CVE-2006-5449. - More information:
-
It was discovered that the Ingo email filter rules manager performs insufficient escaping of user-provided data in created procmail rules files, which allows the execution of arbitrary shell commands.
For the stable distribution (sarge), this problem has been fixed in version 1.0.1-1sarge1.
For the unstable distribution (sid), this problem has been fixed in version 1.1.2-1.
We recommend that you upgrade your ingo1 package.
- Fixed in:
-
Debian GNU/Linux 3.1 (sarge)
- Source:
- http://security.debian.org/pool/updates/main/i/ingo1/ingo1_1.0.1-1sarge1.dsc
- http://security.debian.org/pool/updates/main/i/ingo1/ingo1_1.0.1-1sarge1.diff.gz
- http://security.debian.org/pool/updates/main/i/ingo1/ingo1_1.0.1.orig.tar.gz
- http://security.debian.org/pool/updates/main/i/ingo1/ingo1_1.0.1-1sarge1.diff.gz
- Architecture-independent component:
- http://security.debian.org/pool/updates/main/i/ingo1/ingo1_1.0.1-1sarge1_all.deb
MD5 checksums of the listed files are available in the original advisory.