bugtraq - Re: Sendmail MIME DoS vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20060624055142.GA14172@zardoc.esmtp.org>
Date: Fri, 23 Jun 2006 22:51:42 -0700
From: Claus Assmann <ca+bugtraq@...doc.endmail.org>
To: bugtraq@...urityfocus.com
Subject: Re: Sendmail MIME DoS vulnerability


On Tue, Jun 20, 2006, Jain, Siddhartha wrote:

> The description says that the DoS occurs when sendmail goes in a deeply
> nested malformed MIME message and uses the MIME 8-bit to 7-bit
> conversion function. Under what conditions would sendmail use the MIME
> 8-bit to 7-bit function? Only when the remote MTA doesn't understand
> 8-bit MIME, right?

See the RELEASE_NOTES:

	A malformed MIME structure with many parts can cause sendmail to
		crash while trying to send a mail due to a stack overflow,
		e.g., if the stack size is limited (ulimit -s).  This
		happens because the recursion of the function mime8to7()
		was not restricted.  The function is called for MIME 8 to
		7 bit conversion and also to enforce MaxMimeHeaderLength.
		                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^
		To work around this problem, recursive calls are limited to
		a depth of MAXMIMENESTING (20); message content after this
		limit is treated as opaque and is not checked further.

For details see sendmail/deliver.c, just search for mime8to7().