SMTP: Sendmail 0xff Address Overflow

This signature detects attempts to exploit a known vulnerability in Sendmail versions 8.12.8 and earlier. Under certain conditions, the Sendmail address parser does not perform sufficient bounds checking when converting char to int. Attackers can use this exploit to gain control of the server.

Extended Description

A vulnerability in Sendmail may be exploited remotely to execute arbitrary code. The flaw is present in the 'prescan()' procedure, which is used for processing email addresses in SMTP headers. This condition has been confirmed to be exploitable by remote attackers to execute instructions on target systems. This vulnerability stems from a logic error in the conversion of a char to an integer value. The issue has been fixed Sendmail 8.12.9.

Affected Products

Sun lx50,Hp mpe/ix

References

BugTraq: 7230

CVE: CVE-2003-0161

URL: http://www.kb.cert.org/vuls/id/897604 http://www.sfu.ca/~siegert/linux-security/msg00026.html

Short Name

SMTP:SENDMAIL:SENDMAIL-FF-OF

Severity

Major

Recommended

False

Recommended Action

Drop

SMTP: Sendmail 0xff Address Overflow

Extended Description

Affected Products

References

Found a potential security threat?