Detections
Analytics

Sendmail < 8.11.2 -bt Option Local Overflow

high Nessus Plugin ID 10809

Synopsis

The remote mail server is reportedly affected by a buffer overflow vulnerability.

Description

The remote Sendmail server, according to its version number, may be vulnerable to a '-bt' overflow attack that allows a local user to execute arbitrary commands as root.

Solution

Upgrade to Sendmail version 8.11.2 or later.

See Also

https://seclists.org/bugtraq/2000/Oct/120

https://seclists.org/bugtraq/2001/Jan/12

Plugin Details

Severity: High

ID: 10809

File Name: sendmail_bt_switch.nasl

Version: 1.26

Type: remote

Published: 11/25/2001

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

CVSS Score Rationale: Local user, arbitrary code execution

CVSS v2

Risk Factor: High

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: manual

CVSS v3

Risk Factor: High

Base Score: 8.4

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:sendmail:sendmail

Required KB Items: installed_sw/Sendmail

Vulnerability Publication Date: 10/8/2000