CVE-2003-0694 The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.
HighCVSS 10.0
EPSS 66.2%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sendmail advanced message server | = 1.2 | No fix listed |
| sendmail advanced message server | = 1.3 | No fix listed |
| sendmail | = 2.6 | No fix listed |
| sendmail | = 2.6.1 | No fix listed |
| sendmail | = 2.6.2 | No fix listed |
| sendmail | = 3.0 | No fix listed |
| sendmail | = 3.0.1 | No fix listed |
| sendmail | = 3.0.2 | No fix listed |
| sendmail | = 3.0.3 | No fix listed |
| sendmail | = 8.8.8 | No fix listed |
| sendmail | = 8.9.0 | No fix listed |
| sendmail | = 8.9.1 | No fix listed |
| sendmail | = 8.9.2 | No fix listed |
| sendmail | = 8.9.3 | No fix listed |
| sendmail | = 8.10 | No fix listed |
| sendmail | = 8.10.1 | No fix listed |
| sendmail | = 8.10.2 | No fix listed |
| sendmail | = 8.11.0 | No fix listed |
| sendmail | = 8.11.1 | No fix listed |
| sendmail | = 8.11.2 | No fix listed |
| sendmail | = 8.11.3 | No fix listed |
| sendmail | = 8.11.4 | No fix listed |
| sendmail | = 8.11.5 | No fix listed |
| sendmail | = 8.11.6 | No fix listed |
| sendmail | = 8.12-beta10 | No fix listed |
Show 138 more
| Product | Affected versions | Fixed in |
|---|---|---|
| sendmail | = 8.12-beta12 | No fix listed |
| sendmail | = 8.12-beta16 | No fix listed |
| sendmail | = 8.12-beta5 | No fix listed |
| sendmail | = 8.12-beta7 | No fix listed |
| sendmail | = 8.12.0 | No fix listed |
| sendmail | = 8.12.1 | No fix listed |
| sendmail | = 8.12.2 | No fix listed |
| sendmail | = 8.12.3 | No fix listed |
| sendmail | = 8.12.4 | No fix listed |
| sendmail | = 8.12.5 | No fix listed |
| sendmail | = 8.12.6 | No fix listed |
| sendmail | = 8.12.7 | No fix listed |
| sendmail | = 8.12.8 | No fix listed |
| sendmail | = 8.12.9 | No fix listed |
| sendmail pro | = 8.9.2 | No fix listed |
| sendmail pro | = 8.9.3 | No fix listed |
| sendmail switch | = 2.1 | No fix listed |
| sendmail switch | = 2.1.1 | No fix listed |
| sendmail switch | = 2.1.2 | No fix listed |
| sendmail switch | = 2.1.3 | No fix listed |
| sendmail switch | = 2.1.4 | No fix listed |
| sendmail switch | = 2.1.5 | No fix listed |
| sendmail switch | = 2.2 | No fix listed |
| sendmail switch | = 2.2.1 | No fix listed |
| sendmail switch | = 2.2.2 | No fix listed |
| sendmail switch | = 2.2.3 | No fix listed |
| sendmail switch | = 2.2.4 | No fix listed |
| sendmail switch | = 2.2.5 | No fix listed |
| sendmail switch | = 3.0 | No fix listed |
| sendmail switch | = 3.0.1 | No fix listed |
| sendmail switch | = 3.0.2 | No fix listed |
| sendmail switch | = 3.0.3 | No fix listed |
| sgi irix | = 6.5.15 | No fix listed |
| sgi irix | = 6.5.16 | No fix listed |
| sgi irix | = 6.5.17f | No fix listed |
| sgi irix | = 6.5.17m | No fix listed |
| sgi irix | = 6.5.18f | No fix listed |
| sgi irix | = 6.5.18m | No fix listed |
| sgi irix | = 6.5.19f | No fix listed |
| sgi irix | = 6.5.19m | No fix listed |
| sgi irix | = 6.5.20f | No fix listed |
| sgi irix | = 6.5.20m | No fix listed |
| sgi irix | = 6.5.21f | No fix listed |
| sgi irix | = 6.5.21m | No fix listed |
| apple mac os x | = 10.2 | No fix listed |
| apple mac os x | = 10.2.1 | No fix listed |
| apple mac os x | = 10.2.2 | No fix listed |
| apple mac os x | = 10.2.3 | No fix listed |
| apple mac os x | = 10.2.4 | No fix listed |
| apple mac os x | = 10.2.5 | No fix listed |
| apple mac os x | = 10.2.6 | No fix listed |
| apple mac os x server | = 10.2 | No fix listed |
| apple mac os x server | = 10.2.1 | No fix listed |
| apple mac os x server | = 10.2.2 | No fix listed |
| apple mac os x server | = 10.2.3 | No fix listed |
| apple mac os x server | = 10.2.4 | No fix listed |
| apple mac os x server | = 10.2.5 | No fix listed |
| apple mac os x server | = 10.2.6 | No fix listed |
| compaq tru64 | = 4.0f | No fix listed |
| compaq tru64 | = 4.0f_pk6_bl17 | No fix listed |
| compaq tru64 | = 4.0f_pk7_bl18 | No fix listed |
| compaq tru64 | = 4.0f_pk8_bl22 | No fix listed |
| compaq tru64 | = 4.0g | No fix listed |
| compaq tru64 | = 4.0g_pk3_bl17 | No fix listed |
| compaq tru64 | = 4.0g_pk4_bl22 | No fix listed |
| compaq tru64 | = 5.1 | No fix listed |
| compaq tru64 | = 5.1_pk3_bl17 | No fix listed |
| compaq tru64 | = 5.1_pk4_bl18 | No fix listed |
| compaq tru64 | = 5.1_pk5_bl19 | No fix listed |
| compaq tru64 | = 5.1_pk6_bl20 | No fix listed |
| compaq tru64 | = 5.1a | No fix listed |
| compaq tru64 | = 5.1a_pk1_bl1 | No fix listed |
| compaq tru64 | = 5.1a_pk2_bl2 | No fix listed |
| compaq tru64 | = 5.1a_pk3_bl3 | No fix listed |
| compaq tru64 | = 5.1a_pk4_bl21 | No fix listed |
| compaq tru64 | = 5.1a_pk5_bl23 | No fix listed |
| compaq tru64 | = 5.1b | No fix listed |
| compaq tru64 | = 5.1b_pk1_bl1 | No fix listed |
| compaq tru64 | = 5.1b_pk2_bl22 | No fix listed |
| freebsd | = 3.0-releng | No fix listed |
| freebsd | = 4.0-releng | No fix listed |
| freebsd | = 4.3-release_p38 | No fix listed |
| freebsd | = 4.3-releng | No fix listed |
| freebsd | = 4.4-release_p42 | No fix listed |
| freebsd | = 4.4-releng | No fix listed |
| freebsd | = 4.5-release_p32 | No fix listed |
| freebsd | = 4.5-releng | No fix listed |
| freebsd | = 4.6-release_p20 | No fix listed |
| freebsd | = 4.6-releng | No fix listed |
| freebsd | = 4.7-release_p17 | No fix listed |
| freebsd | = 4.7-releng | No fix listed |
| freebsd | = 4.8-release_p6 | No fix listed |
| freebsd | = 4.8-releng | No fix listed |
| freebsd | = 4.9-pre-release | No fix listed |
| freebsd | = 5.0-release_p14 | No fix listed |
| freebsd | = 5.0-releng | No fix listed |
| freebsd | = 5.1-release_p5 | No fix listed |
| freebsd | = 5.1-releng | No fix listed |
| gentoo linux | = 0.5 | No fix listed |
| gentoo linux | = 0.7 | No fix listed |
| gentoo linux | = 1.1a | No fix listed |
| gentoo linux | = 1.2 | No fix listed |
| gentoo linux | = 1.4-rc1 | No fix listed |
| gentoo linux | = 1.4-rc2 | No fix listed |
| gentoo linux | = 1.4-rc3 | No fix listed |
| HP Inc hp-ux | = 11.00 | No fix listed |
| HP Inc hp-ux | = 11.0.4 | No fix listed |
| HP Inc hp-ux | = 11.11 | No fix listed |
| HP Inc hp-ux | = 11.22 | No fix listed |
| ibm aix | = 4.3.3 | No fix listed |
| ibm aix | = 5.1 | No fix listed |
| ibm aix | = 5.2 | No fix listed |
| netbsd | = 1.4.3 | No fix listed |
| netbsd | = 1.5 | No fix listed |
| netbsd | = 1.5.1 | No fix listed |
| netbsd | = 1.5.2 | No fix listed |
| netbsd | = 1.5.3 | No fix listed |
| netbsd | = 1.6 | No fix listed |
| netbsd | = 1.6-beta | No fix listed |
| netbsd | = 1.6.1 | No fix listed |
| sun solaris | = 2.6 | No fix listed |
| sun solaris | = 7.0 | No fix listed |
| sun solaris | = 8.0 | No fix listed |
| sun solaris | = 9.0 | No fix listed |
| sunos | All versions | No fix listed |
| sunos | = 5.7 | No fix listed |
| sunos | = 5.8 | No fix listed |
| turbolinux advanced server | = 6.0 | No fix listed |
| turbolinux server | = 6.1 | No fix listed |
| turbolinux server | = 6.5 | No fix listed |
| turbolinux server | = 7.0 | No fix listed |
| turbolinux server | = 8.0 | No fix listed |
| turbolinux workstation | = 6.0 | No fix listed |
| turbolinux workstation | = 7.0 | No fix listed |
| turbolinux workstation | = 8.0 | No fix listed |
| debian/sendmail(Debian:12) | < 8.12.10-1 | 8.12.10-1 |
| debian/sendmail(Debian:13) | < 8.12.10-1 | 8.12.10-1 |
| debian/sendmail(Debian:14) | < 8.12.10-1 | 8.12.10-1 |
References
- Debian Security Tracker CVE-2003-0694 vendor-advisory
- 20030917 Sendmail 8.12.9 prescan bug (a new one) [CAN-2003-0694] mailing-list
- 20030917 Zalewski Advisory - Sendmail 8.12.9 prescan bug mailing-list
- CLA-2003:742 vendor-advisory
- 20030917 Sendmail 8.12.9 prescan bug (a new one) [CAN-2003-0694] mailing-list
- 20030917 [slackware-security] Sendmail vulnerabilities fixed (SSA:2003-260-02) mailing-list
- 20030917 GLSA: sendmail (200309-13) mailing-list
- 20030919 [OpenPKG-SA-2003.041] OpenPKG Security Advisory (sendmail) mailing-list
- CA-2003-25 patch third-party-advisory us-government-resource
- DSA-384 vendor-advisory
- VU#784980 third-party-advisory us-government-resource
- MDKSA-2003:092 vendor-advisory
- RHSA-2003:283 vendor-advisory
- RHSA-2003:284 vendor-advisory
- www.sendmail.org patch
- oval:org.mitre.oval:def:2975 signature vdb-entry
- oval:org.mitre.oval:def:572 signature vdb-entry
- oval:org.mitre.oval:def:603 signature vdb-entry