The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.

s700_800 11.23 sendmail(1M) 8.11.1 patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running sendmail. This vulnerability could     allow a remote user to cause a Denial of Service (DoS).
    (HPSBUX02183 SSRT061243)

  - A vulnerability has been identified in sendmail which     may allow a remote attacker to execute arbitrary code.
    References: CVE-2006-0058, US-CERT VU#834865.
    (HPSBUX02108 SSRT061133)

  - A potential security vulnerability has been identified     with HP-UX running sendmail, where the vulnerability     could be exploited remotely to gain unauthorized     privileged access. References: CERT/CC CA-2003-25,     CAN-2003-0681. (HPSBUX00281 SSRT3631)

s700_800 11.11 sendmail(1M) 8.9.3 patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running sendmail, where the vulnerability     could be exploited remotely to gain unauthorized     privileged access. References: CERT/CC CA-2003-25,     CAN-2003-0681. (HPSBUX00281 SSRT3631)

  - A vulnerability has been identified in sendmail which     may allow a remote attacker to execute arbitrary code.
    References: CVE-2006-0058, US-CERT VU#834865.
    (HPSBUX02108 SSRT061133)

  - A potential security vulnerability has been identified     with HP-UX sendmail, where the vulnerability may be     exploited remotely to gain unauthorized access or create     a denial of service (DoS). References: CERT CA-2003-12.
    (HPSBUX00253 SSRT3531)

  - A potential security vulnerability has been identified     with HP-UX running sendmail. This vulnerability could     allow a remote user to cause a Denial of Service (DoS).
    (HPSBUX02183 SSRT061243)

  - A potential security vulnerability has been identified     with HP-UX running sendmail, where the vulnerability may     be exploited remotely to gain unauthorized access and     create a Denial of Service (DoS). References: CERT     CA-2003-07, CAN-2002-1337. (HPSBUX00246 SSRT3469)

s700_800 11.00 sendmail(1M) 8.9.3 patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running sendmail, where the vulnerability may     be exploited remotely to gain unauthorized access and     create a Denial of Service (DoS). References: CERT     CA-2003-07, CAN-2002-1337. (HPSBUX00246 SSRT3469)

  - A vulnerability has been identified in sendmail which     may allow a remote attacker to execute arbitrary code.
    References: CVE-2006-0058, US-CERT VU#834865.
    (HPSBUX02108 SSRT061133)

  - A potential security vulnerability has been identified     with HP-UX running sendmail, where the vulnerability     could be exploited remotely to gain unauthorized     privileged access. References: CERT/CC CA-2003-25,     CAN-2003-0681. (HPSBUX00281 SSRT3631)

  - A potential security vulnerability has been identified     with HP-UX sendmail, where the vulnerability may be     exploited remotely to gain unauthorized access or create     a denial of service (DoS). References: CERT CA-2003-12.
    (HPSBUX00253 SSRT3531)

  - A potential security vulnerability has been identified     with HP-UX running sendmail. This vulnerability could     allow a remote user to cause a Denial of Service (DoS).
    (HPSBUX02183 SSRT061243)

s700_800 11.22 sendmail(1m) 8.11.1 patch : 

A potential security vulnerability has been identified with HP-UX running sendmail, where the vulnerability could be exploited remotely to gain unauthorized privileged access. References: CERT/CC CA-2003-25, CAN-2003-0681.

s700_800 11.04 (VVOS) sendmail(1m) 8.9.3 patch : 

A potential security vulnerability has been identified with HP-UX running sendmail, where the vulnerability could be exploited remotely to gain unauthorized privileged access. References: CERT/CC CA-2003-25, CAN-2003-0681.

Two vulnerabilities were reported in sendmail.

  - CAN-2003-0681 :
    A 'potential buffer overflow in ruleset parsing' for     Sendmail 8.12.9, when using the nonstandard rulesets (1)     recipient (2), final, or (3) mailer-specific envelope     recipients, has unknown consequences.

  - CAN-2003-0694 :

    The prescan function in Sendmail 8.12.9 allows remote     attackers to execute arbitrary code via buffer overflow     attacks, as demonstrated using the parseaddr function in     parseaddr.c.

The remote host is missing AIX Critical Security Patch number IY48658 (Sendmail prescan() vulnerability).

You should install this patch for your system to be up-to-date.

The remote host is missing AIX Critical Security Patch number IY48657 (Sendmail prescan() vulnerability).

You should install this patch for your system to be up-to-date.

The remote Sendmail server may be vulnerable to a remote buffer overflow that can be exploited by an attacker to gain a root shell on this host.

A buffer overflow vulnerability was discovered in the address parsing code in all versions of sendmail prior to 8.12.10 by Michal Zalewski, with a patch to fix the problem provided by Todd C. Miller. This vulnerability seems to be remotely exploitable on Linux systems running on the x86 platform; the sendmail team is unsure of other platforms (CVE-2003-0694).

Another potential buffer overflow was fixed in ruleset parsing which is not exploitable in the default sendmail configuration. A problem may occur if non-standard rulesets recipient (2), final (4), or mailer- specific envelope recipients rulesets are use. This problem was discovered by Timo Sirainen (CVE-2003-0681).

MandrakeSoft encourages all users who use sendmail to upgrade to the provided packages which are patched to fix both problems.

The remote host is missing the patch for the advisory SUSE-SA:2003:040 (sendmail, sendmail-tls).


sendmail is the most widely used mail transport agent (MTA) in the internet. A remotely exploitable buffer overflow has been found in all versions of sendmail that come with SUSE products. These versions include sendmail-8.11 and sendmail-8.12 releases. sendmail is the MTA subsystem that is installed by default on all SUSE products up to and including SUSE LINUX 8.0 and the SUSE LINUX Enterprise Server 7.

The vulnerability discovered is known as the prescan()-bug and is not related to the vulnerability found and fixed in April 2003. The error in the code can cause heap or stack memory to be overwritten, triggered by (but not limited to) functions that parse header addresses. 

There is no known workaround for this vulnerability other than using a different MTA. The vulnerability is triggered by an email message sent through the sendmail MTA subsystem. In that respect, it is different from commonly known bugs that occur in the context of an open TCP connection. By consequence, the vulnerability also exists if email messages get forwarded over a relay that itself does not run a vulnerable MTA. This specific detail and the wide distribution of sendmail in the internet causes this vulnerability to be considered a flaw of major severity. We recommend to install the update packages that are provided for download at the locations listed below.

We thank Michal Zalewski who discovered this vulnerability and the friendly people from Sendmail Inc (Claus Assmann) who have communicated problem to SUSE Security.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

Updated Sendmail packages that fix a potentially-exploitable vulnerability are now available.

Sendmail is a widely used Mail Transport Agent (MTA) and is included in all Red Hat Enterprise Linux distributions.

There is a bug in the prescan() function of Sendmail versions prior to and including 8.12.9. The sucessful exploitation of this bug can lead to heap and stack structure overflows. Although no exploit currently exists, this issue is locally exploitable and may also be remotely exploitable. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0694 to this issue.

All users are advised to update to these erratum packages containing a backported patch which corrects these vulnerabilities.

Red Hat would like to thank Michal Zalewski for finding and reporting this issue.

According to its version number, the remote Sendmail server is between 5.79 to 8.12.9.  Such versions are reportedly vulnerable to remote buffer overflow attacks, one in the 'prescan()' function and another involving its ruleset processing.  A remote user may be able to leverage these issues to gain root privileges.

ID	Name	Product	Family	Severity
26135	HP-UX PHNE_35485 : s700_800 11.23 sendmail(1M) 8.11.1 patch	Nessus	HP-UX Local Security Checks	critical
26134	HP-UX PHNE_35484 : s700_800 11.11 sendmail(1M) 8.9.3 patch	Nessus	HP-UX Local Security Checks	critical
26133	HP-UX PHNE_35483 : s700_800 11.00 sendmail(1M) 8.9.3 patch	Nessus	HP-UX Local Security Checks	critical
16855	HP-UX PHNE_29912 : HP-UX sendmail, Remote Unauthorized Privileged Access (HPSBUX00281 SSRT3631 rev.11)	Nessus	HP-UX Local Security Checks	critical
16704	HP-UX PHNE_30224 : HP-UX sendmail, Remote Unauthorized Privileged Access (HPSBUX00281 SSRT3631 rev.11)	Nessus	HP-UX Local Security Checks	critical
15221	Debian DSA-384-1 : sendmail - buffer overflows	Nessus	Debian Local Security Checks	critical
14619	AIX 5.1 : IY48658	Nessus	AIX Local Security Checks	critical
14606	AIX 5.2 : IY48657	Nessus	AIX Local Security Checks	critical
2043	Sendmail < 8.12.10 prescan() Function Remote Overflow	Nessus Network Monitor	SMTP Servers	medium
14074	Mandrake Linux Security Advisory : sendmail (MDKSA-2003:092)	Nessus	Mandriva Local Security Checks	critical
13808	SUSE-SA:2003:040: sendmail, sendmail-tls	Nessus	SuSE Local Security Checks	critical
12422	RHEL 2.1 : sendmail (RHSA-2003:284)	Nessus	Red Hat Local Security Checks	critical
11838	Sendmail < 8.12.10 prescan() Function Remote Overflow	Nessus	SMTP problems	critical

Detections

Analytics

CVE-2003-0694

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

medium

critical

critical

critical

critical