CVE-2003-0161
published 2003-04-02CVE-2003-0161: The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types…
PriorityP347critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
38.19%
98.4th percentile
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
Affected
107 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
| compaq | tru64 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"GPL SMTP EXPN overflow attempt"; flow:established,to_server; content:"EXPN"; nocase; isdataat:255,relative; content:!"|0a|"; within:255; pcre:"/^EXPN[^\n]{255}/smi"; reference:bugtraq,6991; reference:bugtraq,7230; reference:cve,2002-1337; reference:cve,2003-0161; classtype:attempted-admin; sid:2102259; rev:10; metadata:created_at 2010_09_23, cve CVE_2002_1337, confidence Medium, signature_severity Major, updated_at 2024_03_08;)- →Detect SMTP sessions where RCPT TO or EXPN headers exceed 255 bytes without a newline — indicative of prescan() overflow attempt
- →The exploit embeds 0xff bytes in SMTP address fields to cause Sendmail to misinterpret the value as the special NOCHAR control value, disabling the length check ↗
- →Crash signature for successful PoC exploitation: SIGSEGV at address 0x5c5c5c5c — monitor for sendmail process crashes with this instruction pointer value ↗
- →Characters that cannot be passed through the vulnerable prescan() path (useful for payload filtering/allowlisting): 0x00, 0xff, 0x09-0x0d, 0x20-0x22, 0x25, 0x28, 0x29, 0x2b, 0x2c, 0x2e, 0x2f, 0x3a-0x3c, 0x3e, 0x40, 0x5b, 0x5d, 0x5e, 0x80-0x9f ↗
- ·The vulnerability affects Sendmail versions before 8.12.9; the fix was introduced in 8.12.9. Ensure the installed version is 8.12.9 or later. ↗
- ·The Snort rule (sid:2102259) references both CVE-2002-1337 and CVE-2003-0161 and fires on EXPN overflow patterns; operators should ensure this rule is enabled on SMTP inspection paths and not suppressed.
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vendor_debian10.0CRITICAL
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2259-4w76-9w2p: The prescan() function in the address parser (parseaddr
ghsa_unreviewed·2022-05-03·CVSS 10.0
CVE-2003-0161 [CRITICAL] GHSA-2259-4w76-9w2p: The prescan() function in the address parser (parseaddr
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
OSV
CVE-2003-0161: The prescan() function in the address parser (parseaddr
osv·2003-04-02·CVSS 10.0
CVE-2003-0161 [CRITICAL] CVE-2003-0161: The prescan() function in the address parser (parseaddr
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
Red Hat
security flaw
vendor_redhat·2003-03-29·CVSS 10.0
CVE-2003-0161 [CRITICAL] security flaw
security flaw
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
Debian
CVE-2003-0161: sendmail - The prescan() function in the address parser (parseaddr.c) in Sendmail before 8....
vendor_debian·2003·CVSS 10.0
CVE-2003-0161 [CRITICAL] CVE-2003-0161: sendmail - The prescan() function in the address parser (parseaddr.c) in Sendmail before 8....
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
Scope: local
bookworm: resolved (fixed in 8.12.9-1)
bullseye: resolved (fixed in 8.12.9-1)
forky: resolved (fixed in 8.12.9-1)
sid: resolved (fixed in 8.12.9-1)
trixie: resolved (fixed in 8.12.9-1)
Suricata
GPL SMTP EXPN overflow attempt
suricata·2010-09-23
CVE-2002-1337 GPL SMTP EXPN overflow attempt
GPL SMTP EXPN overflow attempt
Rule: alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"GPL SMTP EXPN overflow attempt"; flow:established,to_server; content:"EXPN"; nocase; isdataat:255,relative; content:!"|0a|"; within:255; pcre:"/^EXPN[^\n]{255}/smi"; reference:bugtraq,6991; reference:bugtraq,7230; reference:cve,2002-1337; reference:cve,2003-0161; classtype:attempted-admin; sid:2102259; rev:10; metadata:created_at 2010_09_23, cve CVE_2002_1337, confidence Medium, signature_severity Major, updated_at 2024_03_08;)
Exploit-DB
Sendmail 8.12.8 (BSD) - 'Prescan()' Remote Command Execution
exploitdb·2003-04-30
CVE-2003-0161 Sendmail 8.12.8 (BSD) - 'Prescan()' Remote Command Execution
Sendmail 8.12.8 (BSD) - 'Prescan()' Remote Command Execution
---
/*
* Sendmail 8.12.8 prescan() PROOF OF CONCEPT exploit by bysin
*
* This is to prove that the bug in sendmail 8.12.8 and below is vulnerable.
* On sucessful POC exploitation the program should crash with the following:
*
* Program received signal SIGSEGV, Segmentation fault.
* 0x5c5c5c5c in ?? ()
*
*/
#include
#include
#include
#include
#include
#include
#include
#include
#include
int maxarch=1;
struct arch {
char *os; // The OS
int pos; // The position of ebp in the stack, with the last byte being 0x00
int apos; // The amount of bytes after pvpbuf where ebp is located
unsigned long addr; // The pointer to the addr buffer
} archs[] = {
{"FreeBSD 4.7-RELEASE",180,28,0xbfbfdad1},
};
//////////////////////////////////////
Exploit-DB
Sendmail 8.11.6 - Address Prescan Memory Corruption
exploitdb·2003-03-29
CVE-2003-0161 Sendmail 8.11.6 - Address Prescan Memory Corruption
Sendmail 8.11.6 - Address Prescan Memory Corruption
---
/*
source: https://www.securityfocus.com/bid/7230/info
A vulnerability in Sendmail may be exploited remotely to execute arbitrary code. The flaw is present in the 'prescan()' procedure, which is used for processing email addresses in SMTP headers. This condition has been confirmed to be exploitable by remote attackers to execute instructions on target systems. This vulnerability stems from a logic error in the conversion of a char to an integer value. The issue has been fixed Sendmail 8.12.9.
*/
/*
* local exploit for sendmail 8.11.6
* by sorbo ([email protected])
* http://www.darkircop.org
*
* This exploit takes advantage of the vulnerable prescan() function that
* allows the user to input 0xff in order to skip the length check of
Bugzilla
CVE-2003-0161 security flaw
bugzilla·2018-08-16·CVSS 10.0
CVE-2003-0161 [CRITICAL] CVE-2003-0161 security flaw
CVE-2003-0161 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
arXiv
DAG-Based Attack and Defense Modeling: Don't Miss the Forest for the Attack Trees
arxiv_fulltext·2013-03-29
DAG-Based Attack and Defense Modeling: Don't Miss the Forest for the Attack Trees
## Abstract
This paper presents the current state of the art on attack and defense
modeling approaches that are based on directed acyclic graphs (DAGs). DAGs
allow for a hierarchical decomposition of complex scenarios into simple, easily
understandable and quantifiable actions. Methods based on threat trees and
Bayesian networks are two well-known approaches to security modeling. However
there exist more than 30 DAG-based methodologies, each having different
features and goals. The objective of this survey is to present a complete
overview of graphical attack and defense modeling techniques based on DAGs.
This consists of summarizing the existing methodologies, comparing their
features and proposing a taxonomy of the described formalisms. This article
also supports the selection of an ade
ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-016.0.txtftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:07.sendmail.ascftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.11/SCOSA-2004.11.txtftp://patches.sgi.com/support/free/security/advisories/20030401-01-Phttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000614http://lists.apple.com/mhonarc/security-announce/msg00028.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2003-March/004295.htmlhttp://marc.info/?l=bugtraq&m=104896621106790&w=2http://marc.info/?l=bugtraq&m=104897487512238&w=2http://marc.info/?l=bugtraq&m=104914999806315&w=2http://sunsolve.sun.com/search/document.do?assetkey=1-26-52620-1http://sunsolve.sun.com/search/document.do?assetkey=1-26-52700-1http://sunsolve.sun.com/search/document.do?assetkey=1-77-1001088.1-1http://www.cert.org/advisories/CA-2003-12.htmlhttp://www.debian.org/security/2003/dsa-278http://www.debian.org/security/2003/dsa-290http://www.gentoo.org/security/en/glsa/glsa-200303-27.xmlhttp://www.kb.cert.org/vuls/id/897604http://www.redhat.com/support/errata/RHSA-2003-120.htmlhttp://www.redhat.com/support/errata/RHSA-2003-121.htmlhttp://www.securityfocus.com/archive/1/316961/30/25250/threadedhttp://www.securityfocus.com/archive/1/317135/30/25220/threadedhttp://www.securityfocus.com/archive/1/317135/30/25220/threadedhttp://www.securityfocus.com/archive/1/321997http://www.securityfocus.com/bid/7230ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-016.0.txtftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:07.sendmail.ascftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.11/SCOSA-2004.11.txtftp://patches.sgi.com/support/free/security/advisories/20030401-01-Phttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000614http://lists.apple.com/mhonarc/security-announce/msg00028.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2003-March/004295.htmlhttp://marc.info/?l=bugtraq&m=104896621106790&w=2http://marc.info/?l=bugtraq&m=104897487512238&w=2http://marc.info/?l=bugtraq&m=104914999806315&w=2http://sunsolve.sun.com/search/document.do?assetkey=1-26-52620-1http://sunsolve.sun.com/search/document.do?assetkey=1-26-52700-1http://sunsolve.sun.com/search/document.do?assetkey=1-77-1001088.1-1http://www.cert.org/advisories/CA-2003-12.htmlhttp://www.debian.org/security/2003/dsa-278http://www.debian.org/security/2003/dsa-290http://www.gentoo.org/security/en/glsa/glsa-200303-27.xmlhttp://www.kb.cert.org/vuls/id/897604http://www.redhat.com/support/errata/RHSA-2003-120.htmlhttp://www.redhat.com/support/errata/RHSA-2003-121.htmlhttp://www.securityfocus.com/archive/1/316961/30/25250/threadedhttp://www.securityfocus.com/archive/1/317135/30/25220/threadedhttp://www.securityfocus.com/archive/1/317135/30/25220/threadedhttp://www.securityfocus.com/archive/1/321997http://www.securityfocus.com/bid/7230
2003-04-02
Published