CVE-2002-1165 Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by in...
MediumCVSS 4.6
EPSS 1.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after (1) "||" sequences or (2) "/" characters, which are not properly filtered or verified.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sendmail | = 8.12.0 | No fix listed |
| sendmail | = 8.12.1 | No fix listed |
| sendmail | = 8.12.2 | No fix listed |
| sendmail | = 8.12.3 | No fix listed |
| sendmail | = 8.12.4 | No fix listed |
| sendmail | = 8.12.5 | No fix listed |
| sendmail | = 8.12.6 | No fix listed |
| netbsd | = 1.5 | No fix listed |
| netbsd | = 1.5.1 | No fix listed |
| netbsd | = 1.5.2 | No fix listed |
| netbsd | = 1.5.3 | No fix listed |
| netbsd | = 1.6 | No fix listed |
| debian/sendmail(Debian:12) | < 8.12.3-5 | 8.12.3-5 |
| debian/sendmail(Debian:13) | < 8.12.3-5 | 8.12.3-5 |
| debian/sendmail(Debian:14) | < 8.12.3-5 | 8.12.3-5 |
References
- CLA-2002:532 vendor-advisory
- 20021001 iDEFENSE Security Advisory 10.01.02: Sendmail smrsh bypass vulnerabilities mailing-list
- 7826 third-party-advisory
- sendmail-forward-bypass-smrsh(10232) vdb-entry vendor-advisory
- MDKSA-2002:083 vendor-advisory
- RHSA-2003:073 vendor-advisory
- 5845 exploit patch vdb-entry vendor-advisory
- www.sendmail.org exploit patch vendor-advisory
- Debian Security Tracker CVE-2002-1165 vendor-advisory