OSAC Item (Printer Friendly Version)

[an error occurred while processing this directive]

CurzTech News Network

OSAC Item (Printer Friendly Version)
from VNU Business Publishing on Monday, March 31, 2003

Vulnerability could allow attacker to gain control of server

Sendmail, the web's most popular email message transfer agent, has released a patch for a 'critical' security vulnerability. The remotely exploitable vulnerability could allow an attacker to gain control of an unpatched Sendmail server.

Security authority the Cert Coordination Centre warned that "parsing code in Sendmail does not adequately check the length of email addresses. An email message with a specially crafted address could trigger a stack overflow."

The vulnerability could be used to cause a denial of service attack and could allow a remote attacker to execute arbitrary code with the privileges of the Sendmail daemon - typically at root level.

"Most organisations have a variety of mail transfer agents [MTAs] at various locations within their network, with at least one exposed to the internet," said Cert.

"Since Sendmail is the most popular MTA, most medium-sized to large organisations are likely to have at least one vulnerable Sendmail server.

"In addition, many Unix and Linux workstations provide a Sendmail implementation that is enabled and running by default."

A patch is available on the Sendmail website, while more information on the vulnerability is available in the Cert advisory at http://www.cert.org/advisories/CA-2003-12.html.

[an error occurred while processing this directive]