Advisories

CERT-In Advisory CIAD-2003-0014

Buffer Overflow in sendmail

Original Issue Date: September 20, 2003

Severity Rating: High

Systems Affected

Open-source sendmail versions prior to 8.12.10, including UNIX and Linux systems
Commercial releases of sendmail including sendmail Switch, sendmail Advanced Message Server SAMS , and sendmail for Windows NT

Overview

This vulnerability occurs due to a bug, identified in the sendmail Mail Transfer Agent MTA that can cause a buffer overflow. The vulnerability derives from a potential buffer overflow in sendmail's header handling code. The vulnerability can provide the ability for an attacker to remotely gain root access to the targeted system.

Impact

Using this vulnerability an attacker can execute arbitrary code and can gain the root access to the sendmail server.

Description

This is a remotely exploitable vulnerability. A specially crafted email message could trigger a stack overflow. This vulnerability is message-oriented as opposed to connection-oriented. An MTA that does not contain the vulnerability will pass the malicious message along to other MTAs. In other words, vulnerable sendmail servers on the interior of a network are still at risk, even if the site's border MTA uses software other than sendmail. Also, messages capable of exploiting this vulnerability may pass undetected through many common packet filters or firewalls.

This affects all computers that run sendmail as their mail server. This does not affect the end users' mail clients. Non-sendmail MTAs will not protect internal sendmail MTAs.

Solution

Users should upgrade to sendmail 8.12.10. A patch is also available from sendmail, and can be applied to sendmail 8.9.x through 8.12.9.

Workaround

Set RunAsUser option, it is typically considered to be a good security practice to limit the privileges of applications and services whenever possible.

Vendor Information

IBM
ftp://ftp.software.ibm.com/aix/efixes/security/sendmail_4_efix.tar.Z
Redhat
http://rhn.redhat.com/errata/RHSA-2003-283.html
Sendmail Inc.
http://www.sendmail.com/security/
Sun
http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/56860

References

CERT Advisory: CA-2003-25 Buffer Management Vulnerability in OpenSSH
http://www.cert.org/advisories/CA-2003-25.html

Sendmail Security Alert
http://www.sendmail.com/security

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-2436857

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India