""ET EXPLOIT Exim/Dovecot Possible MAIL FROM Command Execution""

SID: 2016835

Revision: 2

Class Type: attempted-admin

Metadata: created_at 2013_05_08, updated_at 2013_05_08

Reference:

• Link

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: 25

Flow: to_server,established

Contents:

• Value: "${IFS}"

• Value: "mail from|3a|"

Within:

PCRE: "/^[^\r\n]?\x60[^\x60]?\${IFS}/R"

Special Options:

• nocase

source