Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that causes the setjmp and longjmp function calls to be interrupted and modify unexpected memory locations.

The remote host is missing AIX PTF U806006, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U805069, which is related to the security of the package bos.net.tcp.client.

s700_800 11.23 sendmail(1M) 8.11.1 patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running sendmail. This vulnerability could     allow a remote user to cause a Denial of Service (DoS).
    (HPSBUX02183 SSRT061243)

  - A vulnerability has been identified in sendmail which     may allow a remote attacker to execute arbitrary code.
    References: CVE-2006-0058, US-CERT VU#834865.
    (HPSBUX02108 SSRT061133)

  - A potential security vulnerability has been identified     with HP-UX running sendmail, where the vulnerability     could be exploited remotely to gain unauthorized     privileged access. References: CERT/CC CA-2003-25,     CAN-2003-0681. (HPSBUX00281 SSRT3631)

s700_800 11.11 sendmail(1M) 8.9.3 patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running sendmail, where the vulnerability     could be exploited remotely to gain unauthorized     privileged access. References: CERT/CC CA-2003-25,     CAN-2003-0681. (HPSBUX00281 SSRT3631)

  - A vulnerability has been identified in sendmail which     may allow a remote attacker to execute arbitrary code.
    References: CVE-2006-0058, US-CERT VU#834865.
    (HPSBUX02108 SSRT061133)

  - A potential security vulnerability has been identified     with HP-UX sendmail, where the vulnerability may be     exploited remotely to gain unauthorized access or create     a denial of service (DoS). References: CERT CA-2003-12.
    (HPSBUX00253 SSRT3531)

  - A potential security vulnerability has been identified     with HP-UX running sendmail. This vulnerability could     allow a remote user to cause a Denial of Service (DoS).
    (HPSBUX02183 SSRT061243)

  - A potential security vulnerability has been identified     with HP-UX running sendmail, where the vulnerability may     be exploited remotely to gain unauthorized access and     create a Denial of Service (DoS). References: CERT     CA-2003-07, CAN-2002-1337. (HPSBUX00246 SSRT3469)

s700_800 11.00 sendmail(1M) 8.9.3 patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A potential security vulnerability has been identified     with HP-UX running sendmail, where the vulnerability may     be exploited remotely to gain unauthorized access and     create a Denial of Service (DoS). References: CERT     CA-2003-07, CAN-2002-1337. (HPSBUX00246 SSRT3469)

  - A vulnerability has been identified in sendmail which     may allow a remote attacker to execute arbitrary code.
    References: CVE-2006-0058, US-CERT VU#834865.
    (HPSBUX02108 SSRT061133)

  - A potential security vulnerability has been identified     with HP-UX running sendmail, where the vulnerability     could be exploited remotely to gain unauthorized     privileged access. References: CERT/CC CA-2003-25,     CAN-2003-0681. (HPSBUX00281 SSRT3631)

  - A potential security vulnerability has been identified     with HP-UX sendmail, where the vulnerability may be     exploited remotely to gain unauthorized access or create     a denial of service (DoS). References: CERT CA-2003-12.
    (HPSBUX00253 SSRT3531)

  - A potential security vulnerability has been identified     with HP-UX running sendmail. This vulnerability could     allow a remote user to cause a Denial of Service (DoS).
    (HPSBUX02183 SSRT061243)

Mark Dowd discovered a flaw in the handling of asynchronous signals in sendmail, a powerful, efficient, and scalable mail transport agent.
This allows a remote attacker to exploit a race condition to execute arbitrary code as root.

s700_800 11.04 (VVOS) sendmail(1m) 8.9.3 patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A vulnerability has been identified in sendmail which     may allow a remote attacker to execute arbitrary code.
    References: CVE-2006-0058, US-CERT VU#834865.
    (HPSBUX02108 SSRT061133)

  - A potential security vulnerability has been identified     with HP-UX running Sendmail processing malformed     multipart MIME messages. This vulnerability could     potentially allow a remote unauthenticated user to cause     a Denial of Service (DoS). (HPSBUX02124 SSRT061159)

Updated sendmail packages to fix a security issue are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Sendmail is a Mail Transport Agent (MTA) used to send mail between machines.

A flaw in the handling of asynchronous signals was discovered in Sendmail. A remote attacker may be able to exploit a race condition to execute arbitrary code as root. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0058 to this issue.

By default on Red Hat Enterprise Linux 3 and 4, Sendmail is configured to only accept connections from the local host. Therefore, only users who have configured Sendmail to listen to remote hosts would be able to be remotely exploited by this vulnerability.

Users of Sendmail are advised to upgrade to these erratum packages, which contain a backported patch from the Sendmail team to correct this issue.

s700_800 11.00 sendmail(1m) 8.9.3 patch : 

A vulnerability has been identified in sendmail which may allow a remote attacker to execute arbitrary code. References: CVE-2006-0058, US-CERT VU#834865.

Problem Description A race condition has been reported to exist in the handling by sendmail of asynchronous signals. Impact A remote attacker may be able to execute arbitrary code with the privileges of the user running sendmail, typically root. Workaround There is no known workaround other than disabling sendmail.

Fixes CVE-2006-0058 :

A flaw in the handling of asynchronous signals. A remote attacker may be able to exploit a race condition to execute arbitrary code as root.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Sendmail server is running a version less than 8.13.6.  There is a flaw in versions of Sendmail less than 8.13.6.  At this time, the details are unknown, although it is believed that an attacker can overwrite stack memory with a successful attack.

Updated sendmail packages to fix a security issue are now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Sendmail is a Mail Transport Agent (MTA) used to send mail between machines.

A flaw in the handling of asynchronous signals was discovered in Sendmail. A remote attacker may be able to exploit a race condition to execute arbitrary code as root. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0058 to this issue.

By default on Red Hat Enterprise Linux 2.1, Sendmail is configured to only accept connections from the local host. Therefore only users who have configured Sendmail to listen to remote hosts would be able to be remotely exploited by this vulnerability.

In order to correct this issue for Red Hat Enterprise Linux 2.1 users, it was necessary to upgrade the version of Sendmail from 8.11 as originally shipped to Sendmail 8.12 with the addition of the security patch supplied by Sendmail Inc. This erratum provides updated packages based on Sendmail 8.12 with a compatibility mode enabled. After updating to these packages, users should pay close attention to their sendmail logs to ensure that the upgrade completed sucessfully.

A race condition was reported in sendmail in how it handles asynchronous signals. This could allow a remote attacker to be able to execute arbitrary code with the privileges of the user running sendmail.

The updated packages have been patched to correct this problem via a patch provided by the Sendmail Consortium via CERT.

The remote host is affected by the vulnerability described in GLSA-200603-21 (Sendmail: Race condition in the handling of asynchronous signals)

    ISS discovered that Sendmail is vulnerable to a race condition in     the handling of asynchronous signals.
  Impact :

    An attacker could exploit this via certain crafted timing     conditions.
  Workaround :

    There is no known workaround at this time.

New sendmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a security issue. Sendmail's advisory concerning this issue may be found here:
http://www.sendmail.com/company/advisory/index.shtml

SunOS 5.9_x86: sendmail Patch.
Date this patch was last updated by Sun : Mar/04/08

SunOS 5.9: sendmail patch.
Date this patch was last updated by Sun : Feb/05/08

SunOS 5.8_x86: sendmail patch.
Date this patch was last updated by Sun : Feb/04/08

SunOS 5.8: sendmail patch.
Date this patch was last updated by Sun : Jan/18/08

ID	Name	Product	Family	Severity
65293	AIX 5.2 TL 8 : bos.net.tcp.client (U806006)	Nessus	AIX Local Security Checks	high
65291	AIX 5.3 TL 4 / 5.3 TL 5 : bos.net.tcp.client (U805069)	Nessus	AIX Local Security Checks	high
26135	HP-UX PHNE_35485 : s700_800 11.23 sendmail(1M) 8.11.1 patch	Nessus	HP-UX Local Security Checks	critical
26134	HP-UX PHNE_35484 : s700_800 11.11 sendmail(1M) 8.9.3 patch	Nessus	HP-UX Local Security Checks	critical
26133	HP-UX PHNE_35483 : s700_800 11.00 sendmail(1M) 8.9.3 patch	Nessus	HP-UX Local Security Checks	critical
22557	Debian DSA-1015-1 : sendmail - programming error	Nessus	Debian Local Security Checks	high
22175	HP-UX PHNE_34927 : s700_800 11.04 (VVOS) sendmail(1m) 8.9.3 patch	Nessus	HP-UX Local Security Checks	high
21893	CentOS 3 / 4 : sendmail (CESA-2006:0264)	Nessus	CentOS Local Security Checks	high
21653	HP-UX PHNE_32006 : HP-UX Running sendmail, Remote Execution of Arbitrary Code (HPSBUX02108 SSRT061133 rev.15)	Nessus	HP-UX Local Security Checks	high
21381	FreeBSD : sendmail -- race condition vulnerability (08ac7b8b-bb30-11da-b2fb-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	high
21191	Fedora Core 4 : sendmail-8.13.6-0.FC4.1 (2006-194)	Nessus	Fedora Local Security Checks	high
21190	Fedora Core 5 : sendmail-8.13.6-0.FC5.1 (2006-193)	Nessus	Fedora Local Security Checks	high
3487	Sendmail < 8.13.6 Signal Handler Remote Overflow	Nessus Network Monitor	SMTP Servers	high
21135	RHEL 2.1 : sendmail (RHSA-2006:0265)	Nessus	Red Hat Local Security Checks	high
21134	RHEL 3 / 4 : sendmail (RHSA-2006:0264)	Nessus	Red Hat Local Security Checks	high
21132	Mandrake Linux Security Advisory : sendmail (MDKSA-2006:058)	Nessus	Mandriva Local Security Checks	high
21128	GLSA-200603-21 : Sendmail: Race condition in the handling of asynchronous signals	Nessus	Gentoo Local Security Checks	high
21121	Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : sendmail (SSA:2006-081-01)	Nessus	Slackware Local Security Checks	high
13592	Solaris 9 (x86) : 114137-10	Nessus	Solaris Local Security Checks	high
13541	Solaris 9 (sparc) : 113575-11	Nessus	Solaris Local Security Checks	high
13454	Solaris 8 (x86) : 110616-18	Nessus	Solaris Local Security Checks	high
13350	Solaris 8 (sparc) : 110615-18	Nessus	Solaris Local Security Checks	high

Detections

Analytics

CVE-2006-0058

critical

Tenable Plugins

high

high

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high