Secunia

ISS X-Force has reported a vulnerability in Sendmail, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a signal handling error when receiving and processing mail data from clients. This can be exploited to corrupt memory by sending specially crafted data at certain time intervals.

Successful exploitation allows execution of arbitrary code with the privileges of the sendmail server daemon.

The vulnerability has been reported in the following products:
* Sendmail 8.13.5 and prior
* Sendmail 8.12.11 and prior
* Sendmail Sentrion 1.1
* Sendmail Switch 2.x, 3.0.x, and 3.1.x (Solaris, Linux, AIX, and HP-UX)
* Sendmail Managed MTA 2.x, 3.0.x, and 3.1.x (Solaris, Linux, AIX, and HP-UX)
* Sendmail Multi-Switch 2.x, 3.0.x, and 3.1.x (Solaris, Linux, AIX, and HP-UX)
* Sendmail Message Store/SAMS 1.2.x, 2.0.x, 2.1.x, and 2.2.x (Solaris, Linux, AIX, and HP-UX)
* Intelligent Quarantine 3.0 (Solaris or Linux)

Solution
Update to version 8.13.6 or apply patch.
Further details available in Customer Area

Provided and/or discovered by
Mark Dowd, ISS X-Force.

Original Advisory
ISS X-Force:
http://xforce.iss.net/xforce/alerts/id/216

Sendmail.org:
http://www.sendmail.org/8.13.6.html

Sendmail.com:
http://www.sendmail.com/company/advisory/

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area