CVE-2003-0161 The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled...
HighCVSS 10.0
EPSS 38.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sendmail | = 2.6 | No fix listed |
| sendmail | = 2.6.1 | No fix listed |
| sendmail | = 2.6.2 | No fix listed |
| sendmail | = 3.0 | No fix listed |
| sendmail | = 3.0.1 | No fix listed |
| sendmail | = 3.0.2 | No fix listed |
| sendmail | = 3.0.3 | No fix listed |
| sendmail | = 8.9.0 | No fix listed |
| sendmail | = 8.9.1 | No fix listed |
| sendmail | = 8.9.2 | No fix listed |
| sendmail | = 8.9.3 | No fix listed |
| sendmail | = 8.10 | No fix listed |
| sendmail | = 8.10.1 | No fix listed |
| sendmail | = 8.10.2 | No fix listed |
| sendmail | = 8.11.0 | No fix listed |
| sendmail | = 8.11.1 | No fix listed |
| sendmail | = 8.11.2 | No fix listed |
| sendmail | = 8.11.3 | No fix listed |
| sendmail | = 8.11.4 | No fix listed |
| sendmail | = 8.11.5 | No fix listed |
| sendmail | = 8.11.6 | No fix listed |
| sendmail | = 8.12-beta10 | No fix listed |
| sendmail | = 8.12-beta12 | No fix listed |
| sendmail | = 8.12-beta16 | No fix listed |
| sendmail | = 8.12-beta5 | No fix listed |
Show 87 more
| Product | Affected versions | Fixed in |
|---|---|---|
| sendmail | = 8.12-beta7 | No fix listed |
| sendmail | = 8.12.0 | No fix listed |
| sendmail | = 8.12.1 | No fix listed |
| sendmail | = 8.12.2 | No fix listed |
| sendmail | = 8.12.3 | No fix listed |
| sendmail | = 8.12.4 | No fix listed |
| sendmail | = 8.12.5 | No fix listed |
| sendmail | = 8.12.6 | No fix listed |
| sendmail | = 8.12.7 | No fix listed |
| sendmail | = 8.12.8 | No fix listed |
| sendmail switch | = 2.1 | No fix listed |
| sendmail switch | = 2.1.1 | No fix listed |
| sendmail switch | = 2.1.2 | No fix listed |
| sendmail switch | = 2.1.3 | No fix listed |
| sendmail switch | = 2.1.4 | No fix listed |
| sendmail switch | = 2.1.5 | No fix listed |
| sendmail switch | = 2.2 | No fix listed |
| sendmail switch | = 2.2.1 | No fix listed |
| sendmail switch | = 2.2.2 | No fix listed |
| sendmail switch | = 2.2.3 | No fix listed |
| sendmail switch | = 2.2.4 | No fix listed |
| sendmail switch | = 2.2.5 | No fix listed |
| sendmail switch | = 3.0 | No fix listed |
| sendmail switch | = 3.0.1 | No fix listed |
| sendmail switch | = 3.0.2 | No fix listed |
| sendmail switch | = 3.0.3 | No fix listed |
| compaq tru64 | = 4.0b | No fix listed |
| compaq tru64 | = 4.0d | No fix listed |
| compaq tru64 | = 4.0d_pk9_bl17 | No fix listed |
| compaq tru64 | = 4.0f | No fix listed |
| compaq tru64 | = 4.0f_pk6_bl17 | No fix listed |
| compaq tru64 | = 4.0f_pk7_bl18 | No fix listed |
| compaq tru64 | = 4.0g | No fix listed |
| compaq tru64 | = 4.0g_pk3_bl17 | No fix listed |
| compaq tru64 | = 5.0 | No fix listed |
| compaq tru64 | = 5.0_pk4_bl17 | No fix listed |
| compaq tru64 | = 5.0_pk4_bl18 | No fix listed |
| compaq tru64 | = 5.0a | No fix listed |
| compaq tru64 | = 5.0a_pk3_bl17 | No fix listed |
| compaq tru64 | = 5.0f | No fix listed |
| compaq tru64 | = 5.1 | No fix listed |
| compaq tru64 | = 5.1_pk3_bl17 | No fix listed |
| compaq tru64 | = 5.1_pk4_bl18 | No fix listed |
| compaq tru64 | = 5.1_pk5_bl19 | No fix listed |
| compaq tru64 | = 5.1_pk6_bl20 | No fix listed |
| compaq tru64 | = 5.1a | No fix listed |
| compaq tru64 | = 5.1a_pk1_bl1 | No fix listed |
| compaq tru64 | = 5.1a_pk2_bl2 | No fix listed |
| compaq tru64 | = 5.1a_pk3_bl3 | No fix listed |
| compaq tru64 | = 5.1b | No fix listed |
| compaq tru64 | = 5.1b_pk1_bl1 | No fix listed |
| HP Inc hp-ux | = 10.00 | No fix listed |
| HP Inc hp-ux | = 10.01 | No fix listed |
| HP Inc hp-ux | = 10.08 | No fix listed |
| HP Inc hp-ux | = 10.09 | No fix listed |
| HP Inc hp-ux | = 10.10 | No fix listed |
| HP Inc hp-ux | = 10.16 | No fix listed |
| HP Inc hp-ux | = 10.20 | No fix listed |
| HP Inc hp-ux | = 10.24 | No fix listed |
| HP Inc hp-ux | = 10.26 | No fix listed |
| HP Inc hp-ux | = 10.30 | No fix listed |
| HP Inc hp-ux | = 10.34 | No fix listed |
| HP Inc hp-ux | = 11.00 | No fix listed |
| HP Inc hp-ux | = 11.0.4 | No fix listed |
| HP Inc hp-ux | = 11.11 | No fix listed |
| HP Inc hp-ux | = 11.20 | No fix listed |
| HP Inc hp-ux | = 11.22 | No fix listed |
| HP Inc hp-ux series 700 | = 10.20 | No fix listed |
| HP Inc hp-ux series 800 | = 10.20 | No fix listed |
| HP Inc sis | All versions | No fix listed |
| sun solaris | = 2.4 | No fix listed |
| sun solaris | = 2.5 | No fix listed |
| sun solaris | = 2.5.1 | No fix listed |
| sun solaris | = 2.6 | No fix listed |
| sun solaris | = 7.0 | No fix listed |
| sun solaris | = 8.0 | No fix listed |
| sun solaris | = 9.0 | No fix listed |
| sun solaris | = 9.0-x86_update_2 | No fix listed |
| sunos | All versions | No fix listed |
| sunos | = 5.4 | No fix listed |
| sunos | = 5.5 | No fix listed |
| sunos | = 5.5.1 | No fix listed |
| sunos | = 5.7 | No fix listed |
| sunos | = 5.8 | No fix listed |
| debian/sendmail(Debian:12) | < 8.12.9-1 | 8.12.9-1 |
| debian/sendmail(Debian:13) | < 8.12.9-1 | 8.12.9-1 |
| debian/sendmail(Debian:14) | < 8.12.9-1 | 8.12.9-1 |
References
- Debian Security Tracker CVE-2003-0161 vendor-advisory
- CLA-2003:614 vendor-advisory
- lists.apple.com
- 20030329 Sendmail: -1 gone wild mailing-list
- 20030329 sendmail 8.12.9 available mailing-list
- 20030329 Sendmail: -1 gone wild mailing-list
- 20030330 [OpenPKG-SA-2003.027] OpenPKG Security Advisory (sendmail) mailing-list
- 52620 vendor-advisory
- 52700 vendor-advisory
- 1001088 vendor-advisory
- CA-2003-12 patch third-party-advisory us-government-resource
- DSA-278 vendor-advisory
- DSA-290 vendor-advisory
- GLSA-200303-27 vendor-advisory
- VU#897604 third-party-advisory us-government-resource
- RHSA-2003:120 patch vendor-advisory
- RHSA-2003:121 vendor-advisory
- 20030331 GLSA: sendmail (200303-27) mailing-list
- 20030401 Immunix Secured OS 7+ openssl update mailing-list vendor-advisory
- 20030520 [Fwd: 127 Research and Development: 127 Day!] mailing-list
- 7230 patch vdb-entry vendor-advisory