Test ID:	1.3.6.1.4.1.25623.1.0.50747
Category:	Mandrake Local Security Checks
Title:	Mandrake Security Advisory MDKSA-2003:092 (sendmail)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to sendmail announced via advisory MDKSA-2003:092. A buffer overflow vulnerability was discovered in the address parsing code in all versions of sendmail prior to 8.12.10 by Michal Zalewski, with a patch to fix the problem provided by Todd C. Miller. This vulnerability seems to be remotely exploitable on Linux systems running on the x86 platform the sendmail team is unsure of other platforms (CVE-2003-0694). Another potential buffer overflow was fixed in ruleset parsing which is not exploitable in the default sendmail configuration. A problem may occur if non-standard rulesets recipient (2), final (4), or mailer- specific envelope recipients rulesets are use. This problem was discovered by Timo Sirainen (CVE-2003-0681). MandrakeSoft encourages all users who use sendmail to upgrade to the provided packages which are patched to fix both problems. Affected versions: 8.2, 9.0, 9.1, Corporate Server 2.1 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2003:092 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0681 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0694 http://www.sendmail.org/8.12.10.html http://lists.netsys.com/pipermail/full-disclosure/2003-September/010287.html Risk factor : Critical CVSS Score: 10.0
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0694 Bugtraq: 20030917 GLSA: sendmail (200309-13) (Google Search) http://marc.info/?l=bugtraq&m=106383437615742&w=2 Bugtraq: 20030917 Sendmail 8.12.9 prescan bug (a new one) [CAN-2003-0694] (Google Search) http://marc.info/?l=bugtraq&m=106381604923204&w=2 Bugtraq: 20030917 [slackware-security] Sendmail vulnerabilities fixed (SSA:2003-260-02) (Google Search) http://marc.info/?l=bugtraq&m=106382859407683&w=2 Bugtraq: 20030919 [OpenPKG-SA-2003.041] OpenPKG Security Advisory (sendmail) (Google Search) http://marc.info/?l=bugtraq&m=106398718909274&w=2 http://www.cert.org/advisories/CA-2003-25.html CERT/CC vulnerability note: VU#784980 http://www.kb.cert.org/vuls/id/784980 Conectiva Linux advisory: CLA-2003:742 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000742 Debian Security Information: DSA-384 (Google Search) http://www.debian.org/security/2003/dsa-384 FreeBSD Security Advisory: FreeBSD-SA-03:13 http://archives.neohapsis.com/archives/fulldisclosure/2003-q3/4119.html HPdes Security Advisory: SSRT3631 Immunix Linux Advisory: IMNX-2003-7+-021-01 http://www.mandriva.com/security/advisories?name=MDKSA-2003:092 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2975 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A572 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A603 http://www.redhat.com/support/errata/RHSA-2003-283.html http://www.redhat.com/support/errata/RHSA-2003-284.html SCO Security Bulletin: CSSA-2003-036.0 SCO Security Bulletin: SCOSA-2004.11 ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.11/SCOSA-2004.11.txt http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0113.html Common Vulnerability Exposure (CVE) ID: CVE-2003-0681 BugTraq ID: 8649 http://www.securityfocus.com/bid/8649 CERT/CC vulnerability note: VU#108964 http://www.kb.cert.org/vuls/id/108964 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3606 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A595 XForce ISS Database: sendmail-ruleset-parsing-bo(13216) https://exchange.xforce.ibmcloud.com/vulnerabilities/13216
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.