SERVER-MAIL -- Snort has detected traffic exploiting vulnerabilities in mail servers (such as Exchange, Courrier). These are different from protocol traffic, as this deals with the traffic going to the mail server itself.
SERVER-MAIL OpenSMTPD smtp_mailaddr command injection attempt
This rule looks for attempts to exploit a command injection in OpenSMTPD via crafted "MAIL FROM" or "RCPT TO" SMTP headers.
What To Look For
This rule checks for attempts to exploit a command injection vulnerability in OpenSMTPD.
No public information
No known false positives
Cisco Talos Intelligence Group
MITRE ATT&CK Framework
Technique: Command-Line Interface
For reference, see the MITRE ATT&CK vulnerability types here:
Command Injection attacks target applications that allow unsafe user-supplied input. Attackers transmit this input via forms, cookies, HTTP headers, etc. and exploit the applications permissions to execute system commands without injecting code.
CVE Additional Information
CVE-2020-7247smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
||Ease of Access||LOW