Nessus Plugin #15221

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

[DSA384] DSA-384-1 sendmail

Family:

Debian Local Security Checks

Category:

infos

Copyright:

This script is (C) 2004 Michel Arboi

Summary:

DSA-384-1 sendmail

Version:

$Revision: 1.4 $

Cve_id:

CAN-2003-0681, CAN-2003-0694

Bugtraq_id:

8641, 8649

Xrefs:

DSA:384

Description:

Two vulnerabilities were reported in sendmail.
A "potential buffer overflow in ruleset parsing" for Sendmail
8.12.9, when using the nonstandard rulesets (1) recipient (2),
final, or (3) mailer-specific envelope recipients, has unknown
consequences.
The prescan function in Sendmail 8.12.9 allows remote attackers to
execute arbitrary code via buffer overflow attacks, as demonstrated
using the parseaddr function in parseaddr.c.
For the stable distribution (woody) these problems have been fixed in
sendmail version 8.12.3-6.6 and sendmail-wide version
8.12.3+3.5Wbeta-5.5.
For the unstable distribution (sid) these problems have been fixed in
sendmail version 8.12.10-1.
We recommend that you update your sendmail package.


Solution : http://www.debian.org/security/2003/dsa-384
Risk factor : High