SMTP: Sendmail: Address Prescan Memory Corruption Attack
This signature detects attempts to exploit a known vulnerability in Sendmail SMTP server versions prior to 8.12.9. Because the prescan() procedure that processes e-mail addresses in SMTP headers does not perform some char and int conversions correctly, attackers can send a malicously crafted request to corrupt the Address Prescan Memory on a Sendmail SMTP server and execute arbitrary code.
Extended Description
A vulnerability in Sendmail may be exploited remotely to execute arbitrary code. The flaw is present in the 'prescan()' procedure, which is used for processing email addresses in SMTP headers. This condition has been confirmed to be exploitable by remote attackers to execute instructions on target systems. This vulnerability stems from a logic error in the conversion of a char to an integer value. The issue has been fixed Sendmail 8.12.9.
Affected Products
Sun lx50,Hp mpe/ix
Short Name
SMTP:SENDMAIL:ADDR-PRESCAN-ATK
Severity
Major
Recommended
False
Recommended Action
Drop
Category
SMTP
Keywords
Address Attack CA-2003-12 CVE-2003-0161 Corruption Memory Prescan Sendmail: bid:7230
Release Date
06/18/2003
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3375
False Positive
Unknown
Vendors
Red_hat
Sco
Apple
Sun
Hp
Sendmail,_inc
Ibm
Sgi
Sendmail_consortium
Netbsd
Compaq
CVSS Score
10.0