PT-2006-5235 · Sendmail · Sendmail

Published 2006-08-29 · Updated 2024-02-15 · CVE-2006-4434

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Sendmail versions prior to 8.13.8

Description A use-after-free issue allows remote attackers to cause a denial of service, potentially crashing the system via a long "header line", which causes a previously freed variable to be referenced. The developer has noted that the denial of service is limited to filling up the disk with core dumps if the OS generates different core dumps, and that mail delivery or reception is not affected.

Recommendations For Sendmail versions prior to 8.13.8, update to version 8.13.8 or later to resolve the issue.

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2006-4434

DSA-1164

Affected Products

Sendmail

References · 23

• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102664-1 · Vendor Advisory
• http://securityfocus.com/bid/19714 · Patch
• http://secunia.com/advisories/21637 · Vendor Advisory
• http://openbsd.org/errata38.html#sendmail3 · Vendor Advisory
• http://vupen.com/english/advisories/2006/3393 · Vendor Advisory
• http://secunia.com/advisories/21749 · Vendor Advisory
• http://secunia.com/advisories/22369 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-4434 · Vendor Advisory
• http://securitytracker.com/id?1016753 · Patch
• http://mandriva.com/security/advisories?name=MDKSA-2006:156 · Vendor Advisory
• http://openbsd.org/errata.html#sendmail3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4434 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2006-4434 · Vendor Advisory
• http://secunia.com/advisories/21696 · Vendor Advisory
• http://secunia.com/advisories/21641 · Vendor Advisory