full-disclosure - sendmail vunerability?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1048924348.6856.12.camel@hurina>
From: tss at iki.fi (Timo Sirainen)
Subject: sendmail vunerability?

On Wed, 2003-11-19 at 14:55, nag wrote:
> there is some rumor spreading about new sendmail vulnerability. i do not see
> any news at www.sendmail.org but supposedly ths is remote buffer overflow.
> i received the patch (see below), but o not have any exploit, so please
> don't mail me about it.
> 
> does this look legitimate? any comments? is this something old? is
> this some scam backdoor?

Assuming the address can contain high-ascii characters and it can be
more than twice as long as pvpbsize, this is exploitable. I don't know
if those conditions are prevented anywhere. Pretty interesting hole
anyway, took a while to figure it out.

Another problem may be that it calls isspace() and isascii() for
negative values. Some systems don't like that.