To keep you updated.... If you did not have changed your setup, it's
time to do it now...
Am 07.06.2013 15:53, schrieb Cyborg:
> https://www.redteam-pentesting.de/de/advisories/rt-sa-2013-001/-exim-with-dovecot-typical-misconfiguration-leads-to-remote-command-execution
>
theres now a Metasploit modul for this misconfiguration :
*Exim and Dovecot Insecure Configuration Command Injection*
<
http://packetstormsecurity.com/files/download/121958/exim4_dovecot_exec.rb.txt>
This Metasploit module exploits a command injection vulnerability
against Dovecot with Exim using the "use_shell" option. It uses the
sender's address to inject arbitrary commands since this is one of the
user-controlled variables, which has been successfully tested on Debian
Squeeze using the default Exim4 with dovecot-common packages.
