|
|
CVE Reference: CVE-2006-4434 |
|
| NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE. | |
|
Original Page at CVE MITRE: CVE-2006-4434 |
|
|
Description: Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (crash) via a long "header line", which causes a previously freed variable to be referenced. NOTE: the original developer has disputed the severity of this issue, saying "The only denial of service that is possible here is to fill up the disk with core dumps if the OS actually generates different core dumps (which is unlikely)... the bug is in the shutdown code (finis()) which leads directly to exit(3), i.e., the process would terminate anyway, no mail delivery or receiption is affected." |
|
|
CVE Status: Candidate |
|
|
References: SUSE http://www.novell.com/linux/security/advisories/2006_21_sr.html SUNALERT http://sunsolve.sun.com/search/document.do?assetkey=1-26-102664-1 ST 1016753 SAID Secunia Advisory: SA21637 Secunia Advisory: SA21641 Secunia Advisory: SA21696 Secunia Advisory: SA21700 Secunia Advisory: SA22369 Secunia Advisory: SA21749 OSVDB 28193 OPENBSD http://www.openbsd.org/errata.html#sendmail3 http://www.openbsd.org/errata38.html#sendmail3 MLIST http://www.attrition.org/pipermail/vim/2006-August/000999.html MANDRIVA http://frontal2.mandriva.com/security/advisories?name=MDKSA-2006:156 DEBIAN http://www.debian.org/security/2006/dsa-1164 CONFIRM http://www.sendmail.org/releases/8.13.8.html BID 19714 |
|
| Return to the previous page. |
