Sendmail DNS Maps Remote Denial of Service Vulnerability

BID:8485

Info

Sendmail DNS Maps Remote Denial of Service Vulnerability

Bugtraq ID: 8485
Class: Design Error
CVE: CVE-2003-0688
Remote: Yes
Local: No
Published: Aug 25 2003 12:00AM
Updated: Jul 11 2009 11:56PM
Credit: Discovery of this vulnerability has been credited to Maurice Makaay of InterNLnet B.V.
Vulnerable: SGI IRIX 6.5.21
SGI IRIX 6.5.20
SGI IRIX 6.5.19
SGI IRIX 6.5.18
SGI IRIX 6.5.17
SGI IRIX 6.5.16
SGI IRIX 6.5.15
SGI IRIX 6.5.14
SGI IRIX 6.5.13
SGI IRIX 6.5.12
SGI IRIX 6.5.11
SGI IRIX 6.5.10
SGI IRIX 6.5.9
SGI IRIX 6.5.8
SGI IRIX 6.5.7
SGI IRIX 6.5.6
SGI IRIX 6.5.5
SGI IRIX 6.5.4
SGI IRIX 6.5.3
SGI IRIX 6.5.2
SGI IRIX 6.5.1
SGI IRIX 6.5
Sendmail Consortium Sendmail 8.12.8
+ Redhat Linux 9.0 i386
 + Redhat Linux 8.0 i386
 + Yellow Dog Linux 3.0
Sendmail Consortium Sendmail 8.12.7
+ OpenPKG OpenPKG 1.2
+ Slackware Linux 8.1
+ SOTLinux SOTLinux 2003 Desktop
+ SOTLinux SOTLinux 2003 Server
Sendmail Consortium Sendmail 8.12.6
+ Apple Mac OS X 10.2.4
+ Conectiva Linux Enterprise Edition 1.0
+ FreeBSD FreeBSD 5.0
+ FreeBSD FreeBSD 4.7
+ MandrakeSoft Corporate Server 2.1
+ Mandriva Linux Mandrake 9.0
+ OpenBSD OpenBSD 3.2
 + SuSE Linux 8.1
Sendmail Consortium Sendmail 8.12.5
+ OpenBSD OpenBSD 3.2
 Sendmail Consortium Sendmail 8.12.4
+ OpenBSD OpenBSD 3.2
 + Slackware Linux 8.1
+ Slackware Linux -current
 Sendmail Consortium Sendmail 8.12.3
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
+ FreeBSD FreeBSD 4.6
+ SuSE Linux 8.0 i386
 + SuSE Linux 8.0
Sendmail Consortium Sendmail 8.12.2
+ Apple Mac OS X 10.2.3
+ Apple Mac OS X 10.2.2
+ Apple Mac OS X 10.2.1
+ Apple Mac OS X 10.2
+ Apple Mac OS X Server 10.2.3
+ Apple Mac OS X Server 10.2.2
+ Apple Mac OS X Server 10.2.1
+ Apple Mac OS X Server 10.2
+ OpenBSD OpenBSD 3.1
 Sendmail Consortium Sendmail 8.12.1
+ HP MPE/iX 7.5
+ HP MPE/iX 7.0
+ Mandriva Linux Mandrake 8.2 ppc
 + Mandriva Linux Mandrake 8.2
Redhat sendmail-doc-8.12.8-4.i386.rpm
+ Redhat Linux 9.0 i386
 Redhat sendmail-doc-8.12.5-7.i386.rpm
+ Redhat Linux 8.0 i386
 Redhat sendmail-devel-8.12.8-4.i386.rpm
+ Redhat Linux 9.0 i386
 Redhat sendmail-devel-8.12.5-7.i386.rpm
+ Redhat Linux 8.0 i386
 Redhat sendmail-cf-8.12.8-4.i386.rpm
+ Redhat Linux 9.0 i386
 Redhat sendmail-cf-8.12.5-7.i386.rpm
+ Redhat Linux 8.0 i386
 Redhat sendmail-8.12.8-4.i386.rpm
+ Redhat Linux 9.0 i386
 Redhat sendmail-8.12.5-7.i386.rpm
+ Redhat Linux 8.0 i386
 OpenBSD OpenBSD 3.2
FreeBSD FreeBSD 5.0
FreeBSD FreeBSD 4.8
FreeBSD FreeBSD 4.7
FreeBSD FreeBSD 4.6
Compaq Tru64 5.1 b
Compaq Tru64 5.1 a
Compaq Tru64 5.1
Compaq Tru64 5.0 a
Not Vulnerable: SGI IRIX 6.5.22
SGI IRIX 6.5.18
SGI IRIX 6.5.17
SGI IRIX 6.5.16
SGI IRIX 6.5.15
SGI IRIX 6.5.14
SGI IRIX 6.5.13
SGI IRIX 6.5.12
SGI IRIX 6.5.11
SGI IRIX 6.5.10
SGI IRIX 6.5.9
SGI IRIX 6.5.8
SGI IRIX 6.5.7
SGI IRIX 6.5.6
SGI IRIX 6.5.5
SGI IRIX 6.5.4
SGI IRIX 6.5.3
SGI IRIX 6.5.2
SGI IRIX 6.5.1
SGI IRIX 6.5
Sendmail Consortium Sendmail 8.12.9
+ Slackware Linux 9.0
+ Slackware Linux 8.1
+ Slackware Linux -current
 OpenBSD OpenBSD 3.3

Discussion

Sendmail DNS Maps Remote Denial of Service Vulnerability

A potential vulnerability has been discovered in Sendmail 8.12.x versions prior to 8.12.9, when implementing the use of DNS Maps. The problem specifically lies in the fact that Sendmail fails to properly initialized dynamically allocated data, which may referenced at a later time when freeing memory.

The problem specifically occurs when an invalid DNS reply is returned, specifically one with a differing size than announced. This will cause Sendmail to enter a routine designed to free the final object from a list of the uninitialized structures. The structures are traversed until a NULL pointer is detected, however due to the incorrect initialization the structures may contain garbage data, potentially triggering a call to free() on random data. This would effectively result in Sendmail dereferencing invalid data, causing it to crash.

Theoretically, if this data were to be controlled by an attacker at some point during execution, it may be possible to exploit this issue to execute arbitrary code. This however has not been confirmed.

Exploit / POC

Sendmail DNS Maps Remote Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Sendmail DNS Maps Remote Denial of Service Vulnerability

Solution:
Red Hat has released an advisory (RHSA-2003:265-01) to address this issue. See referenced advisory for further detail regarding applying fixes.

SGI has released a security advisory containing a patch to address this issue in IRIX 6.5.19 - 6.5.21.

A patch haS been released for OpenBSD 3.2, however OpenBSD 3.3 was distributed with Sendmail 8.12.9 and therefore is not affected.

A patch has been released by FreeBSD to address this issue. It has been confirmed to work on FreeBSD 5.0, 4.8, 4.7, and 4.6 systems. Additional details regarding RELENG releases, and other fixed releases can be found in the attached FreeBSD advisory.

Mandrake Linux has released a security advisory containing fixes to address this issue.

Conectiva has released a security advisory (CLA-2003:727) that includes fixes to address this issue.

SOTLinux has released a security advisory (SLSA-2003:39) that includes fixed to address this issue.

HP has released a security bulletin (SSRT3612) for Tru64 UNIX that includes fixes for Sendmail. Please see the attached advisory for details on obtaining and applying fixes. It should be noted that this bulletin has been revised to state that Sendmail versions shipped with Tru64 UNIX 5.1A and 5.1B are not affected by this vulnerability.

This issue has been addressed in Sendmail 8.12.9 and users are urged to upgrade as soon as possible.


OpenBSD OpenBSD 3.2

Redhat sendmail-8.12.5-7.i386.rpm

Redhat sendmail-devel-8.12.8-4.i386.rpm

Redhat sendmail-doc-8.12.8-4.i386.rpm

Redhat sendmail-doc-8.12.5-7.i386.rpm

Redhat sendmail-cf-8.12.5-7.i386.rpm

Redhat sendmail-cf-8.12.8-4.i386.rpm

Redhat sendmail-devel-8.12.5-7.i386.rpm

Redhat sendmail-8.12.8-4.i386.rpm

FreeBSD FreeBSD 4.6

FreeBSD FreeBSD 4.7

FreeBSD FreeBSD 4.8

FreeBSD FreeBSD 5.0

SGI IRIX 6.5.19

SGI IRIX 6.5.20

SGI IRIX 6.5.21

Sendmail Consortium Sendmail 8.12.1

Sendmail Consortium Sendmail 8.12.2

Sendmail Consortium Sendmail 8.12.3

Sendmail Consortium Sendmail 8.12.4

Sendmail Consortium Sendmail 8.12.5

Sendmail Consortium Sendmail 8.12.6

Sendmail Consortium Sendmail 8.12.7

Sendmail Consortium Sendmail 8.12.8

References

Sendmail DNS Maps Remote Denial of Service Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report