PT-2002-2153 · Sendmail · Sendmail

Published 2002-10-03 · Updated 2016-10-18 · CVE-2002-1165

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Sendmail versions 8.11.6 through 8.11.15 Sendmail version 8.12.6

Description: The issue allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after || sequences or / characters, which are not properly filtered or verified.

Recommendations: For Sendmail versions 8.11.6 through 8.11.15, consider restricting access to the smrsh feature until a patch is available. For Sendmail version 8.12.6, consider restricting access to the smrsh feature until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-1165

Affected Products

Sendmail

References · 14

• 🔥 http://securityfocus.com/bid/5845 · Exploit
• 🔥 http://sendmail.org/smrsh.adv.txt · Exploit
• 🔥 https://exploit-db.com/exploits/21884 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2002-1165 · Vendor Advisory
• http://iss.net/security_center/static/10232.php · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2002:083 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000532 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1165 · Security Note
• https://osv.dev/vulnerability/CVE-2002-1165 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2002-1165 · Vendor Advisory
• ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-023.txt.asc · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-073.html · Vendor Advisory
• http://secunia.com/advisories/7826 · Note
• http://marc.info/?l=bugtraq&m=103350914307274&w=2 · Note