PT-2003-1408 · Sendmail · Sendmail

Michal Zalewski · Published 2003-04-01 · Updated 2018-10-30 · CVE-2003-0161

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Sendmail versions prior to 8.12.9

Description: The issue is related to the prescan() function in the address parser, which does not properly handle certain conversions from char and int types. This can cause a length check to be disabled when Sendmail misinterprets an input value as a special control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages.

Recommendations: For Sendmail versions prior to 8.12.9, update to version 8.12.9 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2003-0161

DSA-278

DSA-290

Affected Products

Sendmail

References · 30

• 🔥 https://exploit-db.com/exploits/22442 · Exploit
• 🔥 https://exploit-db.com/exploits/24 · Exploit
• ftp://patches.sgi.com/support/free/security/advisories/20030401-01-P · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-52700-1 · Vendor Advisory
• ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.11/SCOSA-2004.11.txt · Vendor Advisory
• http://debian.org/security/2003/dsa-290 · Vendor Advisory
• http://securityfocus.com/archive/1/317135/30/25220/threaded · Vendor Advisory
• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-016.0.txt · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0161 · Vendor Advisory
• http://cert.org/advisories/CA-2003-12.html · Patch
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000614 · Vendor Advisory
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:07.sendmail.asc · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1001088.1-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0161 · Security Note
• http://securityfocus.com/bid/7230 · Vendor Advisory