Sendmail has been found vulnerable to an issue that could lead to remote root compromise.
Not much details has been released at current, but the release of this information has been co-ordinated between multiple vendors.
It seems that the vulnerability is caused by a boundary error in the function "crackaddr()" when parsing "from:" address header fields containing multiple brackets "<>". A malicious person would be able to exploit the vulnerability by crafting an email with a special "from:" address header field, which could lead to a heap overflow and execution of arbitrary code with "root" privileges.
Sendmail processes as much as 50-75% of all email on the Internet.
Secunia has chosen to rate this issue as extremely critical due to the nature of the service.
The vulnerability could still be exploited if another mail service like qmail initially receives the email and forwards it to a vulnerable sendmail based system.
Do you have additional information related to this advisory?
Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this
information to firstname.lastname@example.org