(Sun Issues Fix for Solaris) Sendmail Mail Server 'Theoretical' Buffer Overflow May Allow Remote Users to Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1012507 |
|
SecurityTracker URL: http://securitytracker.com/id/1012507
|
|
CVE Reference:
CVE-2002-0906
(Links to External Site)
|
Date: Dec 14 2004
|
Impact:
Execution of arbitrary code via network, Root access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 8.12.5
|
Description:
A buffer overflow was reported in Sendmail. A remote user with control of a DNS server may be able to trigger the overflow if the server is configured in a specific manner.
Sendmail, Inc., and the Sendmail Consortium announced that there is 'theoretical' buffer overflow in 'sendmail'. According to the report, the vulnerable code is not used by any configuration shipped with sendmail.
The vulnerability occurs when the DNS map is used with the type TXT and sendmail queries a malicious DNS server.
According to the report, if your system uses a custom DNS map definition to query DNS TXT records (e.g., Kdnstxt dns -R TXT), then your system may be vulnerable.
Sendmail credits Joost Pol of PINE Internet and Anton Rang of Sun Microsystems with independently reporting this flaw.
|
Impact:
A remote user could cause sendmail to execute arbitrary code under a certain specific configuration. The code would likely run with root privileges (although that is not explicitly confirmed in the report). This would allow the remote user to gain root access on the system.
|
Solution:
Sun has issued the following fix:
SPARC Platform
Solaris 9 with patch 113575-01 or later
|
Vendor URL: sunsolve.sun.com/search/document.do?assetkey=1-26-57696-1 (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
UNIX (Solaris - SunOS)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 14 Dec 2004 01:40:35 -0500
Subject: http://sunsolve.sun.com/search/document.do?assetkey=1-26-57696-1
|
Sun issued a fix for a Sendmail vulnerability originally reported in June 2002.
Sun reported that Solaris 9 on SPARC is affected.
Sun has issued the following fix:
SPARC Platform
Solaris 9 with patch 113575-01 or later
-----
Sun Alert ID: 57696
Synopsis: Security Vulnerability When sendmail(1) Does Not Check Length of DNS Replies
Category: Security
Product: Solaris
BugIDs: 4704672
Avoidance: Patch
State: Resolved
Date Released: 08-Dec-2004
Date Closed: 08-Dec-2004
Date Modified:
|
|
