|
Sendmail Signal Handling Memory Corruption Vulnerability
|
|
Secunia Advisory:
|
SA19342
|
|
|
Release Date:
|
2006-03-23
|
|
Popularity:
|
24,477 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Sendmail Sentrion 1.x
|
| | Software: | Intelligent Quarantine 3.x
Sendmail 8.x
Sendmail Managed MTA 2.x
Sendmail Managed MTA 3.x
Sendmail Message Store/SAMS 1.x
Sendmail Message Store/SAMS 2.x
Sendmail Multi-Switch 2.x
Sendmail Multi-Switch 3.x
Sendmail Switch 2.x
Sendmail Switch 3.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
| | CVE reference: | CVE-2006-0058
|
|
Description:
ISS X-Force has reported a vulnerability in Sendmail, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to a signal handling error when receiving and processing mail data from clients. This can be exploited to corrupt memory by sending specially crafted data at certain time intervals.
Successful exploitation allows execution of arbitrary code with the privileges of the sendmail server daemon.
The vulnerability has been reported in the following products:
* Sendmail 8.13.5 and prior
* Sendmail 8.12.11 and prior
* Sendmail Sentrion 1.1
* Sendmail Switch 2.x, 3.0.x, and 3.1.x (Solaris, Linux, AIX, and HP-UX)
* Sendmail Managed MTA 2.x, 3.0.x, and 3.1.x (Solaris, Linux, AIX, and HP-UX)
* Sendmail Multi-Switch 2.x, 3.0.x, and 3.1.x (Solaris, Linux, AIX, and HP-UX)
* Sendmail Message Store/SAMS 1.2.x, 2.0.x, 2.1.x, and 2.2.x (Solaris, Linux, AIX, and HP-UX)
* Intelligent Quarantine 3.0 (Solaris or Linux)
Solution:
Update to version 8.13.6 or apply patch.
Patch for version 8.13.5:
ftp://ftp.sendmail.org/pub/sendmail/8.13.5.p0
Patch for version 8.12.11:
ftp://ftp.sendmail.org/pub/sendmail/8.12.11.p0
Users of the commercial products should see the patch matrix in the vendor advisory for details.
Provided and/or discovered by:
Mark Dowd, ISS X-Force.
Original Advisory:
ISS X-Force:
http://xforce.iss.net/xforce/alerts/id/216
Sendmail.org:
http://www.sendmail.org/8.13.6.html
Sendmail.com:
http://www.sendmail.com/company/advisory/
Other References:
US-CERT VU#834865:
http://www.kb.cert.org/vuls/id/834865
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
6th Oct, 2008
|
New advisories:
|
19 |
|
New vulnerabilities:
|
52 |
|
Updated advisories:
|
26 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 Solutions | More...
|
|
