National Vulnerability Database (CVE-2003-0694)

National Cyber-Alert System Vulnerability Summary: CVE-2003-0694
Orirignal release date: 2003-10-06 Source: US-CERT/NIST ### Overview The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c. ### Impact CVSS Severity: 10 (High) Range: remote Authentication: input buffer="1" Impact Type: sec_prot admin="1" ### Reference to Advisories, Solutions, and Tools External Source: Sendmail Name: Sendmail 8.12.10 Hyperlink: http://www.sendmail.org/8.12.10.html External Source: CERT Name: Buffer Overflow in Sendmail Hyperlink: http://www.cert.org/advisories/CA-2003-25.html External Source: Security Focus Name: bid 8641 Hyperlink: http://www.securityfocus.com/bid/8641 External Source: BUGTRAQ Name: m=106381604923204& Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: VULNWATCH Name: 20030917 Zalewski Advisory - Sendmail 8.12.9 prescan bug Hyperlink: http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0113.html External Source: REDHAT Name: RHSA-2003:283 Hyperlink: http://www.redhat.com/support/errata/RHSA-2003-283.html External Source: REDHAT Name: RHSA-2003:284 Hyperlink: http://www.redhat.com/support/errata/RHSA-2003-284.html External Source: CONECTIVA Name: anuncio=000742 Hyperlink: http://distro.conectiva.com.br/atualizacoes/?id=a& External Source: MANDRAKE Name: MDKSA-2003:092 Hyperlink: http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:092 External Source: DEBIAN Name: DSA-384 Hyperlink: http://www.debian.org/security/2003/dsa-384 External Source: SCO Name: SCOSA-2004.11 Hyperlink: ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.11/SCOSA-2004.11.txt External Source: BUGTRAQ Name: m=106382859407683& Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: BUGTRAQ Name: m=106398718909274& Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: OVAL Name: OVAL572 Hyperlink: http://oval.mitre.org/oval/definitions/data/oval572.html External Source: OVAL Name: OVAL603 Hyperlink: http://oval.mitre.org/oval/definitions/data/oval603.html External Source: OVAL Name: OVAL2975 Hyperlink: http://oval.mitre.org/oval/definitions/data/oval2975.html External Source: FULLDISC Name: 20030917 Sendmail 8.12.9 prescan bug (a new one) [CAN-2003-0694] Hyperlink: http://archives.neohapsis.com/archives/fulldisclosure/2003-q3/4119.html External Source: CERT-VN Name: VU#784980 Hyperlink: http://www.kb.cert.org/vuls/id/784980 External Source: BUGTRAQ Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: CONECTIVA Name: amp Hyperlink: http://distro.conectiva.com.br/atualizacoes/?id=a& External Source: BUGTRAQ Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: BUGTRAQ Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& External Source: BUGTRAQ Name: amp Hyperlink: http://marc.theaimsgroup.com/?l=bugtraq& ### Vulnerable Software and Vendor TurboLinux Workstation (TurboLinux) AIX (IBM) Mac OS X (Apple) Tru64 (Compaq) Gentoo Linux (Gentoo) Solaris (Sun) Sendmail Pro (Sendmail Inc) Sendmail (Sendmail Consortium) IRIX (SGI) HP-UX (HP) TurboLinux Server (TurboLinux) NetBSD (NetBSD) Sendmail Advanced Message Server (Sendmail Inc) Mac OS X Server (Apple) Sendmail (Sendmail Inc) TurboLinux Advanced Server (TurboLinux) FreeBSD (FreeBSD) Sendmail Switch (Sendmail Inc) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0694