Vulnerability Note VU#784980

Sendmail prescan() buffer overflow vulnerability

Overview

Sendmail contains a buffer overflow vulnerability in code that parses email addresses. This vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service on a vulnerable system.

I. Description

Sendmail is a widely used mail transfer agent (MTA). There is a buffer overflow vulnerability in code that parses email addresses.

When processing email messages, sendmail creates tokens from address elements (user, host, domain). The code that performs this function (prescan() in parseaddr.c) contains a vulnerability that could allow a remote attacker to overwrite memory structures and execute arbitary code. The attacker could exploit this vulnerability using an email message with a specially crafted address. Such a message could be passed through MTAs that are not vulnerable.

Further information is available in a message by Michal Zalewski.

This is a different vulnerability than the one described in CA-2003-12/VU#897604.

II. Impact

A remote attacker could execute arbitrary code with the privileges of the Sendmail process, typically root. The attacker may also be able to cause a denial of service.

III. Solution

Upgrade or Patch

Upgrade or apply a patch as specified by your vendor. Sendmail has released version 8.12.10 and a patch that resolve this issue.

Enable RunAsUser

Consider setting the RunAsUser option to reduce the impact of this vulnerability. It is typically considered to be a good security practice to limit the privileges of applications and services whenever possible.

Systems Affected

Vendor	Status	Date Updated
3Com	Unknown	17-Sep-2003
Alcatel	Unknown	18-Sep-2003
Apple Computer Inc.	Vulnerable	25-Sep-2003
AT&T	Unknown	18-Sep-2003
Avaya	Unknown	18-Sep-2003
Cisco Systems Inc.	Unknown	18-Sep-2003
Computer Associates	Unknown	18-Sep-2003
Conectiva	Vulnerable	18-Sep-2003
Cray Inc.	Unknown	18-Sep-2003
D-Link Systems	Unknown	18-Sep-2003
Data General	Unknown	18-Sep-2003
Debian	Vulnerable	18-Sep-2003
Extreme Networks	Unknown	18-Sep-2003
F5 Networks	Not Vulnerable	17-Sep-2003
Foundry Networks Inc.	Unknown	18-Sep-2003
FreeBSD	Vulnerable	25-Sep-2003
Fujitsu	Unknown	18-Sep-2003
Gentoo Linux	Vulnerable	18-Sep-2003
Guardian Digital Inc.	Unknown	18-Sep-2003
Hewlett-Packard Company	Vulnerable	24-Sep-2003
Hitachi	Unknown	18-Sep-2003
IBM	Vulnerable	18-Sep-2003
IBM eServer	Vulnerable	24-Sep-2003
Ingrian Networks	Unknown	18-Sep-2003
Intel	Unknown	18-Sep-2003
Juniper Networks	Unknown	18-Sep-2003
Lotus Software	Not Vulnerable	17-Sep-2003
Lucent Technologies	Unknown	18-Sep-2003
MandrakeSoft	Vulnerable	18-Sep-2003
Microsoft Corporation	Unknown	18-Sep-2003
MontaVista Software	Unknown	18-Sep-2003
Multi-Tech Systems Inc.	Unknown	18-Sep-2003
Multinet	Unknown	18-Sep-2003
NEC Corporation	Unknown	18-Sep-2003
NETBsd	Vulnerable	17-Sep-2003
NetScreen	Unknown	18-Sep-2003
Network Appliance	Not Vulnerable	17-Sep-2003
Nokia	Unknown	18-Sep-2003
Nortel Networks	Unknown	17-Sep-2003
OpenBSD	Unknown	18-Sep-2003
OpenPKG	Vulnerable	24-Sep-2003
Openwall GNU/*/Linux	Not Vulnerable	18-Sep-2003
Oracle Corporation	Unknown	18-Sep-2003
Red Hat Inc.	Vulnerable	18-Sep-2003
Redback Networks Inc.	Unknown	18-Sep-2003
Riverstone Networks	Unknown	18-Sep-2003
SCO	Unknown	18-Sep-2003
Secure Computing Corporation	Vulnerable	24-Sep-2003
Sendmail Inc.	Vulnerable	18-Sep-2003
Sequent	Unknown	18-Sep-2003
SGI	Vulnerable	29-Sep-2003
Slackware	Vulnerable	17-Sep-2003
Sony Corporation	Unknown	18-Sep-2003
Sun Microsystems Inc.	Vulnerable	18-Sep-2003
SuSE Inc.	Vulnerable	24-Sep-2003
Syntegra	Not Vulnerable	25-Sep-2003
The Sendmail Consortium	Vulnerable	18-Sep-2003
TurboLinux	Vulnerable	18-Sep-2003
Unisys	Unknown	18-Sep-2003
Wind River Systems Inc.	Unknown	18-Sep-2003
Wirex	Vulnerable	18-Sep-2003
Xerox	Unknown	18-Sep-2003
ZyXEL	Unknown	18-Sep-2003

References

http://archives.neohapsis.com/archives/fulldisclosure/2003-q3/4119.html
http://archives.neohapsis.com/archives/sendmail/2003-q3/0002.html
http://www.sendmail.org/8.12.10.html
http://www.sendmail.org/patches/parse8.359.2.8

Credit

This vulnerability was discovered by Michal Zalewski.

This document was written by Art Manion.

Other Information

Date Public	09/17/2003
Date First Published	09/17/2003 02:06:12 PM
Date Last Updated	09/29/2003
CERT Advisory	CA-2003-25
CVE Name	CAN-2003-0694
US-CERT Technical Alerts
Metric	36.72
Document Revision	20

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader