|
|
 Buffer Overflow in Sendmail
There is a remotely exploitable vulnerability in sendmail that could allow an
attacker to gain control of a vulnerable sendmail server. Address parsing code
in sendmail does not adequately check the length of email addresses. An email
message with a specially crafted address could trigger a stack overflow. This
vulnerability was discovered by Michal Zalewski.
This vulnerability is different than the one described in CA-2003-07.
Most organizations have a variety of mail transfer agents (MTAs) at various
locations within their network, with at least one exposed to the Internet. Since
sendmail is the most popular MTA, most medium-sized to large organizations are
likely to have at least one vulnerable sendmail server. In addition, many UNIX
and Linux workstations provide a sendmail implementation that is enabled and
running by default.
This vulnerability is message-oriented as opposed to connection-oriented.
That means that the vulnerability is triggered by the contents of a
specially-crafted email message rather than by lower-level network traffic. This
is important because an MTA that does not contain the vulnerability will pass
the malicious message along to other MTAs that may be protected at the network
level. In other words, vulnerable sendmail servers on the interior of a network
are still at risk, even if the site's border MTA uses software other than
sendmail. Also, messages capable of exploiting this vulnerability may pass
undetected through many common packet filters or firewalls.
This vulnerability has been successfully exploited to cause a
denial-of-service condition in a laboratory environment. It is possible that
this vulnerability could be used to execute code on some vulnerable systems.
The CERT/CC is tracking this issue as VU#897604. This reference
number corresponds to CVE candidate CAN-2003-0161.
For more information, please see
- http://www.sendmail.org
- http://www.sendmail.org/8.12.9.html
- http://www.sendmail.com/security/
For the latest information about this vulnerability.
Please see source for more, the and systems effected:- CERT®
:
http://www.cert.org/advisories/CA-2003-12.html
Further Resources: -
http://www.securityfocus.com/advisories/5191
- http://net-security.org/news.php?id=2274
- http://slashdot.org/articles/03/03/29/2052215.shtml?tid=172
|
|
|
 |
|
No Comments Allowed for Anonymous, please register |
|
| |
|
Login |
|
 |
|
|
|
|
· New User? · Click here to create a registered account.
|
|
|
Article Rating |
|
|
|
|
|
|
Average Score: 0
Votes: 0
|
|
|
