Vulnerability Note VU#3278

SunOS versions of sendmail use popen to return undeliverable mail

Original Release date: 04 Jun 2003 | Last revised: 04 Jun 2003

Overview

Older versions of sendmail (circa 1995) incorrectly used popen to process certain arguments.

Description

There is a problem with the way that the older (circa 1995) versions of Sun Microsystems, Inc. version of sendmail processes the -oR option. This problem has been verified as existing in the version of sendmail that is in SunOS 4.1.X, including patches 100377-19 (for SunOS 4.1.3), 101665-04 (for SunOS 4.1.3_U1), and 102423-01 (for SunOS 4.1.4).

The -oR option specifies the host, called the mail hub, to which mail should be forwarded when a user on a client of that hub receives mail. This host can be identified with the -oR option on the command line as

-oRhost_name

or in the configuration file as:

ORhost_name

or by NFS mounting the /var/spool/mail directory from a file server, probably from the mail hub. In this case, the host name of the file server is used as the forwarding host identified as host_name above. All these configurations are vulnerable. For additional information, see CERT Advisory CA-95-11.

Specifically, the problem is that sendmail used popen to process these arguments. By correctly setting IFS and passing in appropriate values to the -oR option, local users could execute arbitrary commands with the privileges of the sendmail. An exploit exists for this problem.

Impact

Local users can obtain root access.

Solution

Upgrade to the most recent version of sendmail.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Sun Microsystems Inc.Affected-04 Jun 2003
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to 8lgm for reporting this vulnerability.

This document was written by Larry Rogers and Shawn Hernan. .

Other Information

  • CVE IDs: Unknown
  • CERT Advisory: CA-1995-11
  • Date Public: 24 Aug 95
  • Date First Published: 04 Jun 2003
  • Date Last Updated: 04 Jun 2003
  • Severity Metric: 0.84
  • Document Revision: 3

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.