CVE-1999-1220: Majordomo 1.94.3 and earlier allows remote attackers to execute arbitrary commands when the advertise or no...

Security readout for executives and security teams

This is an old remote command-execution issue in Majordomo mailing-list software. If a vulnerable configuration uses advertise or noadvertise rules, a crafted Reply-To email header can cause command execution. The main business risk is legacy internet-facing mailing-list infrastructure that has not been retired or replaced. Exposure is most likely on legacy Majordomo 1.94.3 or earlier mailing-list hosts that process inbound email and use advertise or noadvertise directives. The supplied affected-product metadata is incomplete, so asset discovery is required. Prioritize remediation if Majordomo is still internet-facing or business-critical. This is legacy software with remote command-execution impact and sparse modern remediation data, making replacement or retirement the strongest risk-reduction path. Mitigation focus: Inventory systems running Majordomo and confirm whether any are 1.94.3 or earlier.; Check maintainer, operating-system, or distribution guidance for supported fixes or replacement paths.; Retire or replace unsupported Majordomo deployments where possible..

Prepared

Jul 1, 2026, 09:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.