Vulnerability Note VU#3278

SunOS versions of sendmail use popen to return undeliverable mail

The -oR option specifies the host, called the mail hub, to which mail should be forwarded when a user on a client of that hub receives mail. This host can be identified with the -oR option on the command line as

-oRhost_name

or in the configuration file as:

ORhost_name

or by NFS mounting the /var/spool/mail directory from a file server, probably from the mail hub. In this case, the host name of the file server is used as the forwarding host identified as host_name above. All these configurations are vulnerable. For additional information, see CERT Advisory CA-95-11.

Specifically, the problem is that sendmail used popen to process these arguments. By correctly setting IFS and passing in appropriate values to the -oR option, local users could execute arbitrary commands with the privileges of the sendmail. An exploit exists for this problem.

II. Impact

Systems Affected

http://www.alw.nih.gov/Security/8lgm/8lgm-Advisory-21.html
http://www.auscert.org.au/render.html?it=1853&cid=1978

Credit

Thanks to 8lgm for reporting this vulnerability.

This document was written by Larry Rogers and Shawn Hernan. .

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.