PT-2003-1515 · Sendmail · Sendmail

Published 2003-05-15 · Updated 2008-11-11 · CVE-2003-0308

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Sendmail version 8.12.3

Description: The issue is related to the insecure creation of temporary files by the Sendmail package. This could allow local users to gain additional privileges through various means, including the expn, checksendmail, or doublebounce.pl scripts.

Recommendations: For Sendmail version 8.12.3, consider updating to a newer version that securely creates temporary files to prevent local users from gaining additional privileges.

Fix

Related Identifiers

CVE-2003-0308

DSA-305

Affected Products

Sendmail

References · 9

• https://osv.dev/vulnerability/CVE-2003-0308 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0308 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0308 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0308 · Security Note
• http://bugs.debian.org/496408 · Note
• http://dev.gentoo.org/~rbu/security/debiantemp/sendmail-base · Note
• http://openwall.com/lists/oss-security/2008/10/30/2 · Note
• https://bugs.gentoo.org/show_bug.cgi?id=235770 · Note
• http://debian.org/security/2003/dsa-305 · Patch, Vendor Advisory