Skip to Content.
Sympa Menu

sm-security - [SM-Security] [SMGLSA-2006:15] sendmail remote vulnerability

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Arwed von Merkatz <v.merkatz AT gmx.net>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] [SMGLSA-2006:15] sendmail remote vulnerability
  • Date: Thu, 23 Mar 2006 21:41:23 +0100

Sendmail contains a signal race vulnerability when receiving and
processing mail data from remote clients. Sendmail utilizes a signal
handler for dealing with timeouts that is not async-safe and
interruption
of certain functions by this signal handler will cause static data
elements to be left in an inconsistent state. These data elements can be
used to write data to invalid parts of the stack (or heap in some
scenarios), thus taking control of the vulnerable process.

In order to exploit this vulnerability, an attacker simply needs to be
able to connect to sendmail SMTP server. This is a multi-shot exploit,
meaning the attacker can attempt to exploit it an indefinite amount
of times, since sendmail spawns a new process for each connected
client.

For more details, see
http://xforce.iss.net/xforce/alerts/id/216

---
This applies to stable, stable-rc and test grimoires.
All systems using sendmail should update it:
# scribe update
# cast -c sendmail

or

# scribe update
# sorcery queue-security
# cast --queue

--
Arwed v. Merkatz Source Mage GNU/Linux developer
http://www.sourcemage.org

Attachment: pgppJFzY4MpIh.pgp
Description: PGP signature



  • [SM-Security] [SMGLSA-2006:15] sendmail remote vulnerability, Arwed von Merkatz, 03/23/2006

Archive powered by MHonArc 2.6.24.

Top of Page