full-disclosure - [ MDKSA-2006:104 ] - Updated sendmail packages fix remotely exploitable vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu Jun 15 17:29:07 2006
From: vdanen at linsec.ca (Vincent Danen)
Subject: [ MDKSA-2006:104 ] - Updated sendmail packages
	fix remotely exploitable vulnerability

* 3APA3A <3APA3A@...URITY.NNOV.RU> [2006-06-15 12:14:13 +0400]:

> Dear security@...driva.com,
> 
> smc>  References:
>  
> smc>  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1173
> 
> Description  Unspecified  vulnerability  in HP Tru64 UNIX 4.0F PK8 up to
> 5.1B-3  and  HP  Internet  Express  for Tru64 UNIX 6.3 through 6.5, when
> running  Sendmail,  might  allow  remote  attackers to cause a denial of
> service or execute arbitrary code. NOTE: as of 20060607, due to the lack
> of  details,  it  is  not  publicly  known  whether this issue is within
> Sendmail itself, and/or if it is specific to HP.
> 
> smc>  http://www.cert.org/advisories/146718
> 
> Error 404.
> 
> www.sendmail.org
> 
> Recent News
> 
>     * Sendmail 8.13.7 is available (2006-06-14); it contains a fix for a potential denial of service problem caused by excessive recursion which leads to stack exhaustion when attempting delivery of a malformed MIME message.
> 
>     Does Somebody have details?

No, but if you find some, please share.  =)  The details received from
CERT were sketchy, and none of the other referenced docs had much more
info.  Looking at the patch, it looks like it's a mime-nesting issue,
but doesn't really indicate how deep the nesting has to be to trigger
the crash.

The CVE entry should probably be updated as the problem is definitely in
sendmail, and AFAIK it's just a regular DoS as sendmail will crash on a
message with deeply-nested mime messages.  I don't see anything in there
that makes me believe there could be the execution of arbitrary code
(but I could be wrong on that point).

-- 
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}
mysql> SELECT * FROM users WHERE clue > 0;
Empty set (0.00sec)
:: Annvix - Secure Linux Server: http://annvix.org/ ::
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 186 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060615/70ad26ea/attachment.bin