Secunia

Description
Some vulnerabilities have been reported HylaFAX, which can be exploited by malicious people to bypass certain security restrictions and by malicious users to compromise a vulnerable system.

1) An unspecified error exists in "hfaxd" when compiled with PAM support disabled. This may be exploited to login using any password.

The vulnerability has been reported in version 4.2.3.

2) The "notify" script does not properly sanitise user's input before using it. This can be exploited by malicious users to execute arbitrary commands on a vulnerable system.

Successful exploitation requires that the malicious user is able to submit faxes to the server.

The vulnerability has been reported in versions 4.2.0 through 4.2.3.

3) The "faxrcvd" script does not properly sanitise user's input before using it. This can be exploited by malicious users to execute arbitrary commands on a vulnerable system.

Successful exploitation requires that CallID (CIDName/CIDNumber) is configured on the server and the attacker is able to submit non alphanumeric characters as CallID data to the server.

The vulnerability has been reported in version 4.2.2 and 4.2.3.

Solution
Update to version 4.2.4.
Further details available in Customer Area

Provided and/or discovered by
1) Dileep
2-3) Patrice Fournier, iFAX Solutions, Inc.

Original Advisory
http://www.hylafax.org/content/HylaFAX_4.2.4_release
http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=682
http://bugs.hylafax.org/bugzilla/show_bug.cgi?id=719

Deep Links
Links available in Customer Area