CVE-2002-1337 Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the c...
HighCVSS 10.0
EPSS 72.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sendmail | < 8.9.3 | 8.9.3 |
| sendmail | >= 8.10.0, < 8.11.6 | 8.11.6 |
| sendmail | >= 8.12.0, < 8.12.8 | 8.12.8 |
| HP Inc alphaserver sc | All versions | No fix listed |
| gentoo linux | = 1.4-rc1 | No fix listed |
| gentoo linux | = 1.4-rc2 | No fix listed |
| HP Inc hp-ux | = 10.10 | No fix listed |
| HP Inc hp-ux | = 10.20 | No fix listed |
| HP Inc hp-ux | = 11.00 | No fix listed |
| HP Inc hp-ux | = 11.0.4 | No fix listed |
| HP Inc hp-ux | = 11.11 | No fix listed |
| HP Inc hp-ux | = 11.22 | No fix listed |
| netbsd | = 1.5 | No fix listed |
| netbsd | = 1.5.1 | No fix listed |
| netbsd | = 1.5.2 | No fix listed |
| netbsd | = 1.5.3 | No fix listed |
| netbsd | = 1.6 | No fix listed |
| oracle solaris | = 2.6 | No fix listed |
| oracle solaris | = 7.0 | No fix listed |
| oracle solaris | = 8 | No fix listed |
| oracle solaris | = 9 | No fix listed |
| sunos | All versions | No fix listed |
| sunos | = 5.7 | No fix listed |
| sunos | = 5.8 | No fix listed |
| windriver bsdos | = 4.2 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| windriver bsdos | = 4.3.1 | No fix listed |
| windriver bsdos | = 5.0 | No fix listed |
| windriver platform sa | = 1.0 | No fix listed |
| debian/sendmail(Debian:12) | < 8.13.0.PreAlpha4-0 | 8.13.0.PreAlpha4-0 |
| debian/sendmail(Debian:13) | < 8.13.0.PreAlpha4-0 | 8.13.0.PreAlpha4-0 |
| debian/sendmail(Debian:14) | < 8.13.0.PreAlpha4-0 | 8.13.0.PreAlpha4-0 |
References
- Debian Security Tracker CVE-2002-1337 vendor-advisory
- CLA-2003:571 broken-link vendor-advisory
- MDKSA-2003:028 broken-link vendor-advisory
- 20030303 sendmail 8.12.8 available mailing-list third-party-advisory
- 20030304 [LSD] Technical analysis of the remote sendmail vulnerability mailing-list third-party-advisory
- 20030303 Fwd: APPLE-SA-2003-03-03 sendmail mailing-list third-party-advisory
- 20030304 GLSA: sendmail (200303-4) mailing-list third-party-advisory
- HPSBUX0302-246 third-party-advisory vendor-advisory
- IY40500 broken-link vendor-advisory
- IY40501 broken-link vendor-advisory
- IY40502 broken-link vendor-advisory
- CA-2003-07 broken-link patch third-party-advisory us-government-resource
- DSA-257 broken-link vendor-advisory
- 20030303 Remote Sendmail Header Processing Vulnerability broken-link patch third-party-advisory vendor-advisory
- sendmail-header-processing-bo(10748) broken-link vdb-entry
- VU#398025 third-party-advisory us-government-resource
- RHSA-2003:073 broken-link vendor-advisory
- RHSA-2003:074 broken-link vendor-advisory
- RHSA-2003:227 broken-link vendor-advisory
- 6991 broken-link exploit patch third-party-advisory vdb-entry vendor-advisory
- www.sendmail.org broken-link patch vendor-advisory
- oval:org.mitre.oval:def:2222 broken-link signature vdb-entry