Signature Detail
Short Name |
SMTP:SENDMAIL:SENDMAIL-FF-OF |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
SMTP |
Keywords |
Sendmail 0xff Address Overflow |
Release Date |
2003/05/21 |
Update Number |
1213 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
SMTP: Sendmail 0xff Address Overflow
This signature detects attempts to exploit a known vulnerability in Sendmail versions 8.12.8 and earlier. Under certain conditions, the Sendmail address parser does not perform sufficient bounds checking when converting char to int. Attackers can use this exploit to gain control of the server.
Extended Description
A vulnerability in Sendmail may be exploited remotely to execute arbitrary code. The flaw is present in the 'prescan()' procedure, which is used for processing email addresses in SMTP headers. This condition has been confirmed to be exploitable by remote attackers to execute instructions on target systems. This vulnerability stems from a logic error in the conversion of a char to an integer value. The issue has been fixed Sendmail 8.12.9.
Affected Products
- Apple Mac OS X 10.2.0
- Apple Mac OS X 10.2.1
- Apple Mac OS X 10.2.2
- Apple Mac OS X 10.2.3
- Apple Mac OS X 10.2.4
- Apple Mac OS X Server 10.2.0
- Apple Mac OS X Server 10.2.1
- Apple Mac OS X Server 10.2.2
- Apple Mac OS X Server 10.2.3
- Apple Mac OS X Server 10.2.4
- Compaq Tru64 4.0.0 B
- Compaq Tru64 4.0.0 D
- Compaq Tru64 4.0.0 d PK9 (BL17)
- Compaq Tru64 4.0.0 f
- Compaq Tru64 4.0.0 f PK6 (BL17)
- Compaq Tru64 4.0.0 f PK7 (BL18)
- Compaq Tru64 4.0.0 g
- Compaq Tru64 4.0.0 g PK3 (BL17)
- Compaq Tru64 5.0.0
- Compaq Tru64 5.0.0 a
- Compaq Tru64 5.0.0 a PK3 (BL17)
- Compaq Tru64 5.0.0 f
- Compaq Tru64 5.0.0 PK4 (BL17)
- Compaq Tru64 5.0.0 PK4 (BL18)
- Compaq Tru64 5.1.0
- Compaq Tru64 5.1.0 a
- Compaq Tru64 5.1.0 a PK1 (BL1)
- Compaq Tru64 5.1.0 a PK2 (BL2)
- Compaq Tru64 5.1.0 a PK3 (BL3)
- Compaq Tru64 5.1.0 B
- Compaq Tru64 5.1.0 b PK1 (BL1)
- Compaq Tru64 5.1.0 PK3 (BL17)
- Compaq Tru64 5.1.0 PK4 (BL18)
- Compaq Tru64 5.1.0 PK5 (BL19)
- Compaq Tru64 5.1.0 PK6 (BL20)
- HP AlphaServer SC
- HP AltaVista Firewall AVFW98
- HP AltaVista Firewall Raptor EC
- HP HP-UX 10.0.0
- HP HP-UX 10.0.0 1
- HP HP-UX 10.1.0 0
- HP HP-UX 10.10.0
- HP HP-UX 10.16.0
- HP HP-UX 10.20.0
- HP HP-UX 10.20.0 Series 700
- HP HP-UX 10.20.0 Series 800
- HP HP-UX 10.20.0 SIS
- HP HP-UX 10.24.0
- HP HP-UX 10.26.0
- HP HP-UX 10.30.0
- HP HP-UX 10.34.0
- HP HP-UX 10.8.0
- HP HP-UX 10.9.0
- HP HP-UX 11.0.0
- HP HP-UX 11.0.0 4
- HP HP-UX 11.11.0
- HP HP-UX 11.20.0
- HP HP-UX 11.22.0
- HP HP-UX B.11.00
- HP HP-UX B.11.04
- HP HP-UX B.11.11
- HP HP-UX B.11.22
- HP HP-UX (VVOS) 10.24.0
- HP HP-UX (VVOS) 11.0.0 4
- HP HP-UX (VVOS) 11.0.4
- HP Internet Express 5.4.0
- HP Internet Express 5.7.0
- HP Internet Express 5.8.0
- HP Internet Express 5.9.0
- HP Internet Express 6.0.0
- HP MPE/iX 6.0.0
- HP MPE/iX 6.5.0
- HP MPE/iX 7.0.0
- HP MPE/iX 7.5.0
- HP NonStop-UX PUMA
- HP NonStop-UX Whitney
- HP Tru64 5.1.0 a PK4 (BL21)
- IBM AIX 4.3.0
- IBM AIX 4.3.1
- IBM AIX 4.3.2
- IBM AIX 4.3.3
- IBM AIX 5.1
- IBM AIX 5.1.0 L
- IBM AIX 5.2
- IBM MVS
- IBM OS/390 V2R10
- IBM OS/390 V2R6
- IBM OS/390 V2R8
- IBM OS/390 V2R9
- IBM z/OS V1R2
- IBM z/OS V1R4
- IBM z/OS
- NetBSD 1.5.0
- NetBSD 1.5.1
- NetBSD 1.5.2
- NetBSD 1.5.3
- NetBSD 1.6.0
- Red Hat Advanced Workstation for the Itanium Processor 2.1.0
- Red Hat Enterprise Linux AS 2.1
- Red Hat Enterprise Linux ES 2.1
- Red Hat Enterprise Linux WS 2.1
- SCO OpenLinux Server 3.1.1
- SCO OpenLinux Workstation 3.1.1
- Sendmail Consortium Sendmail 8.10.0
- Sendmail Consortium Sendmail 8.10.1
- Sendmail Consortium Sendmail 8.10.2
- Sendmail Consortium Sendmail 8.11.0
- Sendmail Consortium Sendmail 8.11.1
- Sendmail Consortium Sendmail 8.11.2
- Sendmail Consortium Sendmail 8.11.3
- Sendmail Consortium Sendmail 8.11.4
- Sendmail Consortium Sendmail 8.11.5
- Sendmail Consortium Sendmail 8.11.6
- Sendmail Consortium Sendmail 8.12.0 .0
- Sendmail Consortium Sendmail 8.12.0 Beta10
- Sendmail Consortium Sendmail 8.12.0 Beta12
- Sendmail Consortium Sendmail 8.12.0 Beta16
- Sendmail Consortium Sendmail 8.12.0 Beta5
- Sendmail Consortium Sendmail 8.12.0 Beta7
- Sendmail Consortium Sendmail 8.12.1
- Sendmail Consortium Sendmail 8.12.2
- Sendmail Consortium Sendmail 8.12.3
- Sendmail Consortium Sendmail 8.12.4
- Sendmail Consortium Sendmail 8.12.5
- Sendmail Consortium Sendmail 8.12.6
- Sendmail Consortium Sendmail 8.12.7
- Sendmail Consortium Sendmail 8.12.8
- Sendmail Consortium Sendmail 8.9.0 .0
- Sendmail Consortium Sendmail 8.9.1
- Sendmail Consortium Sendmail 8.9.2
- Sendmail Consortium Sendmail 8.9.3
- Sendmail, Inc Sendmail for NT 2.6.0
- Sendmail, Inc Sendmail for NT 2.6.1
- Sendmail, Inc Sendmail for NT 2.6.2
- Sendmail, Inc Sendmail for NT 3.0.0
- Sendmail, Inc Sendmail for NT 3.0.1
- Sendmail, Inc Sendmail for NT 3.0.2
- Sendmail, Inc Sendmail for NT 3.0.3
- Sendmail, Inc Sendmail Switch 2.1.0
- Sendmail, Inc Sendmail Switch 2.1.1
- Sendmail, Inc Sendmail Switch 2.1.2
- Sendmail, Inc Sendmail Switch 2.1.3
- Sendmail, Inc Sendmail Switch 2.1.4
- Sendmail, Inc Sendmail Switch 2.1.5
- Sendmail, Inc Sendmail Switch 2.2.0
- Sendmail, Inc Sendmail Switch 2.2.1
- Sendmail, Inc Sendmail Switch 2.2.2
- Sendmail, Inc Sendmail Switch 2.2.3
- Sendmail, Inc Sendmail Switch 2.2.4
- Sendmail, Inc Sendmail Switch 2.2.5
- Sendmail, Inc Sendmail Switch 3.0.0
- Sendmail, Inc Sendmail Switch 3.0.1
- Sendmail, Inc Sendmail Switch 3.0.2
- Sendmail, Inc Sendmail Switch 3.0.3
- SGI IRIX 6.5.0
- SGI IRIX 6.5.1
- SGI IRIX 6.5.10
- SGI IRIX 6.5.11
- SGI IRIX 6.5.12
- SGI IRIX 6.5.13
- SGI IRIX 6.5.14
- SGI IRIX 6.5.15
- SGI IRIX 6.5.16
- SGI IRIX 6.5.17
- SGI IRIX 6.5.18
- SGI IRIX 6.5.19
- SGI IRIX 6.5.2
- SGI IRIX 6.5.3
- SGI IRIX 6.5.4
- SGI IRIX 6.5.5
- SGI IRIX 6.5.6
- SGI IRIX 6.5.7
- SGI IRIX 6.5.8
- SGI IRIX 6.5.9
- Sun Cobalt Qube3 4000WG
- Sun Cobalt RaQ4 3001R
- Sun Cobalt RaQ 550 4100R
- Sun Cobalt RaQ XTR 3500R
- Sun Linux 5.0.0
- Sun LX50
- Sun Solaris 2.4
- Sun Solaris 2.4_x86
- Sun Solaris 2.5
- Sun Solaris 2.5.1
- Sun Solaris 2.5.1_ppc
- Sun Solaris 2.5.1_x86
- Sun Solaris 2.5_x86
- Sun Solaris 2.6
- Sun Solaris 2.6_x86
- Sun Solaris 7.0
- Sun Solaris 7.0_x86
- Sun Solaris 8 Sparc
- Sun Solaris 8 X86
- Sun Solaris 9 Sparc
- Sun Solaris 9 X86
- Sun Solaris 9 X86 Update 2
References
- BugTraq: 7230
- CERT: CA-2003-12
- CVE: CVE-2003-0161
- URL: http://www.sfu.ca/~siegert/linux-security/msg00026.html
- URL: http://www.kb.cert.org/vuls/id/897604