SMTP: "ETRN" Command

This signature detects attempts to exploit a known vulnerability against the ETRN command in Sendmail. When the SMTP server receives a remote ETRN command, the fork() is called and sleeps for five seconds. Attackers can connect, send large amounts of ETRN commands to the Sendmail server, and then disconnect to overload system resources and cause a denial-of-service condition.

Extended Description

There is a low-bandwidth dos vulnerability in Sendmail. When a client connects to the sendmail smtpd and sends an ETRN command to the server, the server fork()s and sleeps for 5 seconds. If many ETRN commands are sent to a server, it is possible to exhaust system resources and cause a denial of service or even a reboot of the server.

Affected Products

Eric_allman sendmail

Short Name
SMTP:COMMAND:ETRN
Severity
Major
Recommended
False
Recommended Action
None
Category
SMTP
Keywords
"ETRN" CVE-1999-1109 Command bid:904
Release Date
04/22/2003
Supported Platforms

srx-branch-12.3

srx-19.3

srx-branch-19.3

vsrx3bsd-19.2

srx-branch-19.4

vsrx-19.4

mx-12.3

mx-19.4

vmx-19.4

mx-19.3

vsrx3bsd-19.4

srx-19.4

vsrx-12.3

vmx-19.3

vsrx-19.2

srx-12.3

Sigpack Version
3788
False Positive
Unknown
Vendors

Eric_allman

CVSS Score

5.0

Found a potential security threat?