clamav-milter black-hole-mode RCE (CVE-2007-4560)

CVE-2007-4560 is a remote command execution in clamav-milter (before 0.91.2) when integrated with Sendmail in --black-hole-mode. A milter (mail filter) is a program Sendmail invokes for each email; clamav-milter uses it to run messages through the ClamAV antivirus. The --black-hole-mode mode changes its behaviour: instead of just scanning, the milter takes part in delivery and, in doing so, internally builds a command line with the recipient address.

The problem is that this address is not sanitised. If the recipient has the form nobody+"|command", the milter interpolates the string into a shell line and executes the command. And since clamav-milter normally runs as root, the command inherits that context: it is direct command injection to root, with no intermediate escalation.

The public exploit (4761.pl) opens an SMTP conversation and places two poisoned RCPT TO. A common payload appends a bind shell to inetd and restarts it:

RCPT TO: nobody+"|echo '31337 stream tcp nowait root /bin/sh -i' >> /etc/inetd.conf"
RCPT TO: nobody+"|/etc/init.d/inetd restart"

After it runs, every connection to port 31337 launches /bin/sh -i as root.

How you get there. The decisive hint usually comes from SNMP enumeration: the process table exposes clamav-milter --black-hole-mode. Without it, the Sendmail looks like just another mail service. SMTP user enumeration confirms along the way that the server processes our raw commands.

Why it happens. A component running with high privileges (the milter as root) builds a command line out of attacker-controlled data (the recipient) without escaping it. The --black-hole-mode mode, intended to drop mail, turned that field into an execution vector.

How to detect it. The signature lives in Sendmail's SMTP log: RCPT TO: commands whose recipient has the form nobody+"|command" (a pipe and a command inside the address), something no legitimate mail client sends. On the host, the pattern is process lineage: clamav-milter/sendmail (as root) spawning sh/echo/init.d as a child, and the modification of /etc/inetd.conf or a new listening port (31337) that a FIM and a netstat reveal. An outbound connection or a new service after a mail with an odd recipient closes the chain.

Defence. Upgrade ClamAV to 0.91.2 or later, do not run the milter as root, and avoid --black-hole-mode unless truly needed. In general, never build shell lines by concatenating external input.