search menu icon-carat-right cmu-wordmark

CERT Coordination Center


SunOS versions of sendmail use popen to return undeliverable mail

Vulnerability Note VU#3278

Original Release Date: 2003-06-04 | Last Revised: 2003-06-04

Overview

Older versions of sendmail (circa 1995) incorrectly used popen to process certain arguments.

Description

There is a problem with the way that the older (circa 1995) versions of Sun Microsystems, Inc. version of sendmail processes the -oR option. This problem has been verified as existing in the version of sendmail that is in SunOS 4.1.X, including patches 100377-19 (for SunOS 4.1.3), 101665-04 (for SunOS 4.1.3_U1), and 102423-01 (for SunOS 4.1.4).

The -oR option specifies the host, called the mail hub, to which mail should be forwarded when a user on a client of that hub receives mail. This host can be identified with the -oR option on the command line as

-oRhost_name

or in the configuration file as:

ORhost_name

or by NFS mounting the /var/spool/mail directory from a file server, probably from the mail hub. In this case, the host name of the file server is used as the forwarding host identified as host_name above. All these configurations are vulnerable. For additional information, see CERT Advisory CA-95-11.

Specifically, the problem is that sendmail used popen to process these arguments. By correctly setting IFS and passing in appropriate values to the -oR option, local users could execute arbitrary commands with the privileges of the sendmail. An exploit exists for this problem.

Impact

Local users can obtain root access.

Solution

Upgrade to the most recent version of sendmail.

Vendor Information

3278
Expand all

Sun Microsystems Inc.

Updated:  June 04, 2003

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

This problem was addressed by Sun around the time it was first discovered, circa 1995.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

Thanks to 8lgm for reporting this vulnerability.

This document was written by Larry Rogers and Shawn Hernan.

Other Information

CVE IDs: None
CERT Advisory: CA-1995-11
Severity Metric: 0.84
Date Public: 1995-08-24
Date First Published: 2003-06-04
Date Last Updated: 2003-06-04 18:44 UTC
Document Revision: 3

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.