National Cyber-Alert System

Vulnerability Summary for CVE-2003-0694

Overview

The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

CERT/CC Advisory: CA-2003-25

Name: CA-2003-25

Type: Advisory; Patch Information

Hyperlink:http://www.cert.org/advisories/CA-2003-25.html

US-CERT Vulnerability Note: VU#784980

Name: VU#784980

Hyperlink:http://www.kb.cert.org/vuls/id/784980

External Source: CONFIRM

Name: http://www.sendmail.org/8.12.10.html

Type: Patch Information

Hyperlink:http://www.sendmail.org/8.12.10.html

External Source: REDHAT

Name: RHSA-2003:284

Hyperlink:http://www.redhat.com/support/errata/RHSA-2003-284.html

External Source: REDHAT

Name: RHSA-2003:283

Hyperlink:http://www.redhat.com/support/errata/RHSA-2003-283.html

External Source: DEBIAN

Name: DSA-384

Hyperlink:http://www.debian.org/security/2003/dsa-384

External Source: BUGTRAQ

Name: 20030919 [OpenPKG-SA-2003.041] OpenPKG Security Advisory (sendmail)

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=106398718909274&w=2

External Source: BUGTRAQ

Name: 20030917 GLSA: sendmail (200309-13)

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=106383437615742&w=2

External Source: BUGTRAQ

Name: 20030917 [slackware-security] Sendmail vulnerabilities fixed (SSA:2003-260-02)

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=106382859407683&w=2

External Source: BUGTRAQ

Name: 20030917 Sendmail 8.12.9 prescan bug (a new one) [CAN-2003-0694]

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=106381604923204&w=2

External Source: CONECTIVA

Name: CLA-2003:742

Hyperlink:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000742

External Source: VULNWATCH

Name: 20030917 Zalewski Advisory - Sendmail 8.12.9 prescan bug

Hyperlink:http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0113.html

External Source: FULLDISC

Name: 20030917 Sendmail 8.12.9 prescan bug (a new one) [CAN-2003-0694]

Hyperlink:http://archives.neohapsis.com/archives/fulldisclosure/2003-q3/4119.html

External Source: SCO

Name: SCOSA-2004.11

Hyperlink:ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.11/SCOSA-2004.11.txt

External Source: MANDRAKE

Name: MDKSA-2003:092

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2003:092

US Government Resource: oval:org.mitre.oval:def:603

Name: oval:org.mitre.oval:def:603

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:603

US Government Resource: oval:org.mitre.oval:def:572

Name: oval:org.mitre.oval:def:572

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:572

US Government Resource: oval:org.mitre.oval:def:2975

Name: oval:org.mitre.oval:def:2975

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2975