CVE-2002-1337
published 2003-03-07CVE-2002-1337: Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and…
PriorityP261critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
72.20%
99.4th percentile
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
Affected
129 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xeb\x0c\x5b\x31\xc0\x50\x89\xe1\x89\xe2\xb0\x0b\xcd\x80\xe8\xef\xff\xff\xff
bytes↗
\xeb\x02\xeb\x08\xe8\xf9\xff\xff\xff\xcd\x7f\xc3\x5f\xff\x47\x01\x31\xc0\x50\x6a\x01\x6a\x02\x54\x59\xb0\x66\x31\xdb\x43\xff\xd7
- →The exploit triggers the crackaddr() buffer overflow via crafted SMTP header fields (Full-name:, From:, Subject:) containing angle brackets and parentheses with embedded NOP sleds (0xf8) and shellcode. Monitor for anomalously large or malformed SMTP headers containing these patterns. ↗
- →The vulnerability is in the crackaddr() function of headers.c in Sendmail 5.79 through 8.12.7. Patch to 8.12.8 or later to remediate. ↗
- →The remote exploit (LSD PoC) connects back to the attacker on a listener port (2525 by default). Monitor for unexpected outbound connections from the sendmail process, especially to non-standard ports. ↗
- →The local privilege escalation exploit drops working files in /tmp/.sxp. Monitor for creation of this directory by the sendmail process or its children. ↗
- →The exploit targets Slackware 8.0 with sendmail 8.11.4 (aptr=0xbfffbe34) and uses a fixed stack address. Detect exploitation attempts by monitoring for sendmail spawning /bin/bash or /bin/sh as a child process. ↗
- ·The LSD remote exploit (DOC 3) explicitly states only Slackware 8.0 is supported as a target OS for the provided offsets; other distributions require different pointer/offset values. ↗
- ·The local privilege escalation exploit (DOC 2) requires sendmail to be setuid; it will warn and may fail if the binary is not setuid. ↗
- ·The exploit uses a brute-force mode that may take 20-30 minutes to complete, which could be a distinguishing characteristic for detection of slow/low exploitation attempts. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vendor_debian10.0CRITICAL
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2259-4w76-9w2p: The prescan() function in the address parser (parseaddr
ghsa_unreviewed·2022-05-03·CVSS 10.0
CVE-2003-0161 [CRITICAL] GHSA-2259-4w76-9w2p: The prescan() function in the address parser (parseaddr
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
GHSA
GHSA-2vpw-h4q9-62fp: Buffer overflow in Sendmail 5
ghsa_unreviewed·2022-05-03
CVE-2002-1337 [HIGH] GHSA-2vpw-h4q9-62fp: Buffer overflow in Sendmail 5
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
OSV
CVE-2003-0161: The prescan() function in the address parser (parseaddr
osv·2003-04-02·CVSS 10.0
CVE-2003-0161 [CRITICAL] CVE-2003-0161: The prescan() function in the address parser (parseaddr
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
OSV
CVE-2002-1337: Buffer overflow in Sendmail 5
osv·2003-03-07·CVSS 10.0
CVE-2002-1337 [CRITICAL] CVE-2002-1337: Buffer overflow in Sendmail 5
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
Red Hat
security flaw
vendor_redhat·2003-03-29·CVSS 10.0
CVE-2003-0161 [CRITICAL] security flaw
security flaw
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
Red Hat
security flaw
vendor_redhat·2003-03-03·CVSS 10.0
CVE-2002-1337 [CRITICAL] security flaw
security flaw
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
Debian
CVE-2003-0161: sendmail - The prescan() function in the address parser (parseaddr.c) in Sendmail before 8....
vendor_debian·2003·CVSS 10.0
CVE-2003-0161 [CRITICAL] CVE-2003-0161: sendmail - The prescan() function in the address parser (parseaddr.c) in Sendmail before 8....
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
Scope: local
bookworm: resolved (fixed in 8.12.9-1)
bullseye: resolved (fixed in 8.12.9-1)
forky: resolved (fixed in 8.12.9-1)
sid: resolved (fixed in 8.12.9-1)
trixie: resolved (fixed in 8.12.9-1)
Debian
CVE-2002-1337: sendmail - Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute ar...
vendor_debian·2002·CVSS 10.0
CVE-2002-1337 [CRITICAL] CVE-2002-1337: sendmail - Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute ar...
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
Scope: local
bookworm: resolved (fixed in 8.13.0.PreAlpha4-0)
bullseye: resolved (fixed in 8.13.0.PreAlpha4-0)
forky: resolved (fixed in 8.13.0.PreAlpha4-0)
sid: resolved (fixed in 8.13.0.PreAlpha4-0)
trixie: resolved (fixed in 8.13.0.PreAlpha4-0)
Suricata
GPL SMTP EXPN overflow attempt
suricata·2010-09-23
CVE-2002-1337 GPL SMTP EXPN overflow attempt
GPL SMTP EXPN overflow attempt
Rule: alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"GPL SMTP EXPN overflow attempt"; flow:established,to_server; content:"EXPN"; nocase; isdataat:255,relative; content:!"|0a|"; within:255; pcre:"/^EXPN[^\n]{255}/smi"; reference:bugtraq,6991; reference:bugtraq,7230; reference:cve,2002-1337; reference:cve,2003-0161; classtype:attempted-admin; sid:2102259; rev:10; metadata:created_at 2010_09_23, cve CVE_2002_1337, confidence Medium, signature_severity Major, updated_at 2024_03_08;)
Exploit-DB
Sendmail 8.12.x - Header Processing Buffer Overflow (1)
exploitdb·2003-03-02
CVE-2002-1337 Sendmail 8.12.x - Header Processing Buffer Overflow (1)
Sendmail 8.12.x - Header Processing Buffer Overflow (1)
---
// source: https://www.securityfocus.com/bid/6991/info
Sendmail is prone to a remotely buffer-overflow vulnerability in the SMTP header parsing component. Successful attackers may exploit this vulnerability to gain control of affected servers.
Reportedly, this vulnerability may be locally exploitable if the sendmail binary is setuid/setgid.
Sendmail 5.2 to 8.12.7 are affected. Administrators are advised to upgrade to 8.12.8 or to apply patches to earlier versions of the 8.12.x tree.
/*## copyright LAST STAGE OF DELIRIUM mar 2003 poland *://lsd-pl.net/ #*/
/*## sendmail 8.11.6 #*/
/* proof of concept code for remote sendmail vulnerability */
/* usage: linx86_sendmail target [-l localaddr] [-b localport] [-p ptr] */
/* [-c co
Exploit-DB
Sendmail 8.12.x - Header Processing Buffer Overflow (2)
exploitdb·2003-03-02
CVE-2002-1337 Sendmail 8.12.x - Header Processing Buffer Overflow (2)
Sendmail 8.12.x - Header Processing Buffer Overflow (2)
---
// source: https://www.securityfocus.com/bid/6991/info
Sendmail is prone to a remotely buffer-overflow vulnerability in the SMTP header parsing component. Successful attackers may exploit this vulnerability to gain control of affected servers.
Reportedly, this vulnerability may be locally exploitable if the sendmail binary is setuid/setgid.
Sendmail 5.2 to 8.12.7 are affected. Administrators are advised to upgrade to 8.12.8 or to apply patches to earlier versions of the 8.12.x tree.
/* Sendmail
#include
#include
#include
#include
#include
#include
#include
#include
int maxarch=1;
struct arch {
char *os;
int angle,nops;
unsigned long aptr;
} archs[] = {
{"Slackware 8.0 with sendmail 8.11.4",138,1,0xbfffbe34}
};
///////////
Exploit-DB
Sendmail 8.11.x (Linux/i386) - Local Privilege Escalation
exploitdb·2001-01-01
CVE-2002-1337 Sendmail 8.11.x (Linux/i386) - Local Privilege Escalation
Sendmail 8.11.x (Linux/i386) - Local Privilege Escalation
---
/*
sendmail 8.11.x exploit (i386-Linux) by [email protected] (sd@ircnet)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This code exploits well-known local-root bug in sendmail 8.11.x,
8.12.x may be vulnerable too, but I didn't test it.
It gives instant root shell with +s sendmail 8.11.x, x
#include
#include
#include
#include
#include
#include
#include
#include
#define SM "/usr/sbin/sendmail"
#define OBJDUMP "objdump"
#define GDB "gdb"
#define GREP "grep"
#define OURDIR "/tmp/.sxp"
/* an basic regexp to get interesting stuff from disassembled output
change it as you like if something doesn't work */
#define DLINE "%s -d %s 2> /dev/null | %s -B %d \"mov.*%%.l,(%%e..,%%e..,1)\" | %s \".mov .*0x80.*,%%e..\""
#define DL
Bugzilla
CVE-2003-0161 security flaw
bugzilla·2018-08-16·CVSS 10.0
CVE-2003-0161 [CRITICAL] CVE-2003-0161 security flaw
CVE-2003-0161 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
Bugzilla
CVE-2002-1337 security flaw
bugzilla·2018-08-16·CVSS 10.0
CVE-2002-1337 [CRITICAL] CVE-2002-1337 security flaw
CVE-2002-1337 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-002.txt.ascftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.6ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.5ftp://patches.sgi.com/support/free/security/advisories/20030301-01-Phttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000571http://frontal2.mandriva.com/security/advisories?name=MDKSA-2003:028http://marc.info/?l=bugtraq&m=104673778105192&w=2http://marc.info/?l=bugtraq&m=104678739608479&w=2http://marc.info/?l=bugtraq&m=104678862109841&w=2http://marc.info/?l=bugtraq&m=104678862409849&w=2http://marc.info/?l=bugtraq&m=104679411316818&w=2http://www-1.ibm.com/support/search.wss?rs=0&q=IY40500&apar=onlyhttp://www-1.ibm.com/support/search.wss?rs=0&q=IY40501&apar=onlyhttp://www-1.ibm.com/support/search.wss?rs=0&q=IY40502&apar=onlyhttp://www.cert.org/advisories/CA-2003-07.htmlhttp://www.debian.org/security/2003/dsa-257http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21950http://www.iss.net/security_center/static/10748.phphttp://www.kb.cert.org/vuls/id/398025http://www.redhat.com/support/errata/RHSA-2003-073.htmlhttp://www.redhat.com/support/errata/RHSA-2003-074.htmlhttp://www.redhat.com/support/errata/RHSA-2003-227.htmlhttp://www.securityfocus.com/bid/6991http://www.sendmail.org/8.12.8.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2222ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-002.txt.ascftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.6ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.5ftp://patches.sgi.com/support/free/security/advisories/20030301-01-Phttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000571http://frontal2.mandriva.com/security/advisories?name=MDKSA-2003:028http://marc.info/?l=bugtraq&m=104673778105192&w=2http://marc.info/?l=bugtraq&m=104678739608479&w=2http://marc.info/?l=bugtraq&m=104678862109841&w=2http://marc.info/?l=bugtraq&m=104678862409849&w=2http://marc.info/?l=bugtraq&m=104679411316818&w=2http://www-1.ibm.com/support/search.wss?rs=0&q=IY40500&apar=onlyhttp://www-1.ibm.com/support/search.wss?rs=0&q=IY40501&apar=onlyhttp://www-1.ibm.com/support/search.wss?rs=0&q=IY40502&apar=onlyhttp://www.cert.org/advisories/CA-2003-07.htmlhttp://www.debian.org/security/2003/dsa-257http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21950http://www.iss.net/security_center/static/10748.phphttp://www.kb.cert.org/vuls/id/398025http://www.redhat.com/support/errata/RHSA-2003-073.htmlhttp://www.redhat.com/support/errata/RHSA-2003-074.htmlhttp://www.redhat.com/support/errata/RHSA-2003-227.htmlhttp://www.securityfocus.com/bid/6991http://www.sendmail.org/8.12.8.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2222
2003-03-07
Published