A remote overflow exists in Sendmail. The "prescan()" function fails to perform proper bounds checking resulting in a buffer overflow. By using an email message with a specially crafted address, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Upgrade to version 8.12.10 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Secunia Advisory ID: 11780 12178 9758
• ISS X-Force ID: 13204
• CVE ID: 2003-0681 (see also: NVD) 2003-0694 (see also: NVD)
• CERT VU: 784980
• Bugtraq ID: 8641
• CERT: CA-2003-25
• Vendor Specific Advisory URL: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-016.txt.asc ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-036.0.txt ftp://patches.sgi.com/support/free/security/advisories/20031001-01-U.asc http://cc.turbolinux.com/security/TLSA-2003-52.txt
  http://distro.conectiva.com/atualizacoes/index.php?id=a&anuncio=000742
  http://docs.info.apple.com/article.html?artnum=61798
  http://sendmail.org/8.12.10.html
  http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F56860&zone_32=category%3Asecurity
  http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/57573
  http://www-1.ibm.com/services/continuity/recover1.nsf/MSS/MSS-OAR-E01-2003.1314.1
  http://www.debian.org/security/2003/dsa-384
  http://www.linuxsecurity.com/advisories/immunix_advisory-3652.html
  http://www.openbsd.org/errata33.html#sendmail
  http://www.suse.de/de/security/2003_040_sendmail.html
  https://rhn.redhat.com/errata/RHSA-2003-283.html
• Other Advisory URL: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.11/SCOSA-2004.11.txt
• Mail List Post: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0113.html
• Generic Exploit URL: http://packetstormsecurity.nl/0405-exploits/gyan_sendmail.c
• CIAC Advisory: n-149

• Michal Zalewski - lcamtufdione.ids.pl - Personal page