Vulnerability Note VU#108964

Sendmail contains buffer overflow in ruleset parsing

Original Release date: 18 Sep 2003 | Last revised: 18 Sep 2003

Overview

Sendmail contains a buffer overflow vulnerability in the code that parses rulesets. This vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on a vulnerable system.This vulnerability does not affect the default configuration.

Description

Sendmail is a widely used mail transfer agent (MTA). There is a buffer overflow vulnerability in the code that parses rulesets. A system is vulnerable if it is configured to use the non-standard rulesets recipient (2), final (4), or mailer-specific envelope recipients.

This is a different vulnerability than the one described in CA-2003-25/VU#784980.

Impact

Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on a vulnerable system.

Solution

This issue is resolved in Sendmail 8.12.10.Beta2.

Download the commercial version from:


or the open-source version from:

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
SendmailAffected-18 Sep 2003
Sendmail Inc.Affected-18 Sep 2003
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Timo Sirainen for reporting this vulnerability.

This document was written by Jason A Rafail.

Other Information

  • CVE IDs: Unknown
  • Date Public: 01 Jul 2003
  • Date First Published: 18 Sep 2003
  • Date Last Updated: 18 Sep 2003
  • Severity Metric: 6.33
  • Document Revision: 7

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.