search menu icon-carat-right cmu-wordmark

CERT Coordination Center

SunOS versions of sendmail use popen to return undeliverable mail

Vulnerability Note VU#3278

Original Release Date: 2003-06-04 | Last Revised: 2003-06-04


Older versions of sendmail (circa 1995) incorrectly used popen to process certain arguments.


There is a problem with the way that the older (circa 1995) versions of Sun Microsystems, Inc. version of sendmail processes the -oR option. This problem has been verified as existing in the version of sendmail that is in SunOS 4.1.X, including patches 100377-19 (for SunOS 4.1.3), 101665-04 (for SunOS 4.1.3_U1), and 102423-01 (for SunOS 4.1.4).

The -oR option specifies the host, called the mail hub, to which mail should be forwarded when a user on a client of that hub receives mail. This host can be identified with the -oR option on the command line as


or in the configuration file as:


or by NFS mounting the /var/spool/mail directory from a file server, probably from the mail hub. In this case, the host name of the file server is used as the forwarding host identified as host_name above. All these configurations are vulnerable. For additional information, see CERT Advisory CA-95-11.

Specifically, the problem is that sendmail used popen to process these arguments. By correctly setting IFS and passing in appropriate values to the -oR option, local users could execute arbitrary commands with the privileges of the sendmail. An exploit exists for this problem.


Local users can obtain root access.


Upgrade to the most recent version of sendmail.

Vendor Information


Sun Microsystems Inc. Affected

Updated:  June 04, 2003



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


This problem was addressed by Sun around the time it was first discovered, circa 1995.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



Thanks to 8lgm for reporting this vulnerability.

This document was written by Larry Rogers and Shawn Hernan. .

Other Information

CVE IDs: None
CERT Advisory: CA-1995-11
Severity Metric: 0.84
Date Public: 1995-08-24
Date First Published: 2003-06-04
Date Last Updated: 2003-06-04 18:44 UTC
Document Revision: 4

Sponsored by CISA.