Sendmail ruleset parsing buffer overflow
| sendmail-ruleset-parsing-bo (13216) |  High Risk |
Description:
Sendmail is vulnerable to a buffer overflow in the ruleset parsing. If the recipient, final, or mailer-specific envelope recipients rulesets are used, which are not configured by default, a remote attacker could overflow a buffer and possibly cause a denial of service or execute arbitrary code on the system.
Consequences:
Gain Access
Remedy:
Upgrade to the latest version of Sendmail (8.12.10 or later), available from the Sendmail Web site. See References.
For HP-UX 11.00, 11.04, 11.11, 11.22, and 11.23:
Download and install the appropriate sendmail file for this vulnerability, as listed in Hewlett-Packard Company Security Bulletin HPSBUX0309-281. See References.
For Debian GNU/Linux 3.0 (woody):
Upgrade to the latest sendmail package (8.12.3-6.6 or later), as listed in DSA-384-1. See References.
For Red Hat Linux:
Upgrade to the latest sendmail package, as listed below. Refer to RHSA-2003:283-09 for more information. See References.
Red Hat 7.1: 8.11.6-27.71 or later
Red Hat 7.2: 8.11.6-27.72 or later
Red Hat 7.3: 8.11.6-27.73 or later
Red Hat 8.0: 8.12.8-9.80 or later
Red Hat 9: 8.12.8-9.90 or later
For Mandrake Linux:
Upgrade to the latest sendmail package, as listed below. Refer to Mandrake Linux Security Advisory MDKSA-2003:092 for more information. See References.
Mandrake Linux 8.2: 8.12.1-4.5mdk or later
Mandrake Linux 9.0: 8.12.6-3.5mdk or later
Mandrake Corporate Server 2.1: 8.12.6-3.5mdk or later
For Turbolinux:
Upgrade to the latest sendmail package (8.12.10-1 or later), as listed in Turbolinux Security Advisory TLSA-2003-52. See References.
For Immunix 7+:
Upgrade to the latest version of sendmail (8.11.6-3_imnx_6 or later), as listed in Immunix Secured OS Security Advisory IMNX-2003-7+-021-01. See References.
For Conectiva Linux:
Upgrade to the latest sendmail package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2003:742 for more information. See References.
Conectiva Linux 7.0: 8.11.6-1U70_5cl or later
Conectiva Linux 8: 8.11.6-2U80_5cl or later
Conectiva Linux 9: 8.12.5-26986U90_3cl or later
For OpenPKG:
Upgrade to the latest sendmail package, as listed below. Refer to OpenPKG Security Advisory OpenPKG-SA-2003.041 for more information. See References.
OpenPKG CURRENT: 8.12.10-20030917 or later
OpenPKG 1.2: 8.12.7-1.2.4 or later
OpenPKG 1.3: 8.12.9-1.3.1 or later
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- AppleCare Knowledge Base Document 61798: Security Update 2003-08-14. (Mac OS X 10.2.8:CAN-2003-0681 to fix a buffer overflow in address parsing, as well as a potential buffer overflow in ruleset parsing.)
- Conectiva Linux Security Announcement CLSA-2003:742: sendmail.
- Immunix Secured OS Security Advisory IMNX-2003-7+-021-01: sendmail. (From LinuxSecurity archive)
- Sendmail Web site: Sendmail 8.12.10.
- BID-8649: Sendmail Ruleset Parsing Buffer Overflow Vulnerability
- CVE-2003-0681: A potential buffer overflow in ruleset parsing for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences.
- DSA-384: sendmail -- buffer overflows
- MDKSA-2003:092: Updated sendmail packages fix buffer overflow vulnerability
- OpenPKG-SA-2003.041: Sendmail
- RHSA-2003-283: Updated Sendmail packages fix vulnerability.
Platforms Affected:
- Conectiva Linux 7.0
- Conectiva Linux 8.0
- Conectiva Linux 9.0
- Debian Debian Linux 3.0
- HP HP-UX 11.00
- HP HP-UX 11.04
- HP HP-UX 11.11
- HP HP-UX 11.22
- HP HP-UX 11.23
- Immunix Immunix OS 7+-beta
- MandrakeSoft Mandrake Linux 8.2
- MandrakeSoft Mandrake Linux 8.2 PPC
- MandrakeSoft Mandrake Linux 9.0
- MandrakeSoft Mandrake Linux 9.1
- MandrakeSoft Mandrake Linux 9.1 PPC
- MandrakeSoft Mandrake Linux Corporate Server 2.1 X86_64
- MandrakeSoft Mandrake Linux Corporate Server 2.1
- OpenPKG OpenPKG 1.2
- OpenPKG OpenPKG 1.3
- OpenPKG OpenPKG CURRENT
- RedHat Linux 7.1
- RedHat Linux 7.2
- RedHat Linux 7.3
- RedHat Linux 8.0
- RedHat Linux 9.0
- Sendmail Advanced Message Server 1.2
- Sendmail Advanced Message Server 1.3
- Sendmail Sendmail 2.6
- Sendmail Sendmail 2.6.1
- Sendmail Sendmail 2.6.2
- Sendmail Sendmail 3.0
- Sendmail Sendmail 3.0.1
- Sendmail Sendmail 3.0.2
- Sendmail Sendmail 3.0.3
- Sendmail Sendmail 8.10
- Sendmail Sendmail 8.10.1
- Sendmail Sendmail 8.10.2
- Sendmail Sendmail 8.11
- Sendmail Sendmail 8.11.1
- Sendmail Sendmail 8.11.2
- Sendmail Sendmail 8.11.3
- Sendmail Sendmail 8.11.4
- Sendmail Sendmail 8.11.5
- Sendmail Sendmail 8.11.6
- Sendmail Sendmail 8.12 Beta10
- Sendmail Sendmail 8.12 Beta12
- Sendmail Sendmail 8.12 Beta16
- Sendmail Sendmail 8.12 Beta7
- Sendmail Sendmail 8.12 Beta5
- Sendmail Sendmail 8.12.0
- Sendmail Sendmail 8.12.1
- Sendmail Sendmail 8.12.2
- Sendmail Sendmail 8.12.3
- Sendmail Sendmail 8.12.4
- Sendmail Sendmail 8.12.5
- Sendmail Sendmail 8.12.6
- Sendmail Sendmail 8.12.7
- Sendmail Sendmail 8.12.8
- Sendmail Sendmail 8.12.9
- Sendmail Sendmail 8.8.8
- Sendmail Sendmail 8.9.0
- Sendmail Sendmail 8.9.1
- Sendmail Sendmail 8.9.2
- Sendmail Sendmail 8.9.3
- Sendmail Sendmail Pro 8.9.2
- Sendmail Sendmail Pro 8.9.3
- Sendmail Sendmail Switch 2.1
- Sendmail Sendmail Switch 2.1.1
- Sendmail Sendmail Switch 2.1.2
- Sendmail Sendmail Switch 2.1.3
- Sendmail Sendmail Switch 2.1.4
- Sendmail Sendmail Switch 2.1.5
- Sendmail Sendmail Switch 2.2
- Sendmail Sendmail Switch 2.2.1
- Sendmail Sendmail Switch 2.2.2
- Sendmail Sendmail Switch 2.2.3
- Sendmail Sendmail Switch 2.2.4
- Sendmail Sendmail Switch 2.2.5
- Sendmail Sendmail Switch 3.0
- Sendmail Sendmail Switch 3.0.1
- Sendmail Sendmail Switch 3.0.2
- Sendmail Sendmail Switch 3.0.3
- Turbolinux Turbolinux 7 Server
- Turbolinux Turbolinux 7 Workstation
- Turbolinux Turbolinux 8 Server
- Turbolinux Turbolinux 8 Workstation
- Turbolinux Turbolinux Advanced Server 6
- Turbolinux Turbolinux Server 6.1
- Turbolinux Turbolinux Server 6.5
- Turbolinux Turbolinux Workstation 6.0
Reported:
Not available
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net