Bug#432932: metasend: Slightly exploitable MIME type setting
The mime type setting isn't the only one.
-A '"xxx; foo=xxx echo headshot"'
headshot
also works nicely.
It is several lines of eval ctype${multipart}=\"$ctype\" and similar that
shows these.
Just search for eval in the code and almost all of them does this.
But unless mime types is added by untrusted people, it isn't a real problem.
/Sune
--
Do you know how may I doubleclick on the gadget?
You can never close the TCP microprocessor, this way from Debian LinuxPPC NT
and from the control tools within DOS XP you must load the head on a virus to
a forward for mounting the case.
signature.asc
Description: This is a digitally signed message part.
Bug#432932: metasend: Slightly exploitable MIME type setting
Package: metamail Version: 2.7-53 Hi! I hope that the MIME type supplied to metasend will always come from a trusted source: [EMAIL PROTECTED]:~$ metasend -b -s "Some subject" -o \ -F "[EMAIL PROTECTED]" \ -m 'foo/bar; name="xxx echo you are dead"' \ -e quoted-printable -f /dev/null\ -t "[EMAIL PROTECTED]" you are dead [EMAIL PROTECTED]:~$ This is due the use of `eval', which is a typo and should be spelled like `evil' ... MfG, JBG -- Jan-Benedict Glaw [EMAIL PROTECTED] +49-172-7608481 Signature of:Don't believe in miracles: Rely on them! the second : signature.asc Description: Digital signature
