English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 74154 CVE descriptions
and 39337 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.51460
Category:Conectiva Local Security Checks
Title:Conectiva Security Advisory CLA-2003:742
Summary:Conectiva Security Advisory CLA-2003:742
Description:
The remote host is missing updates announced in
advisory CLA-2003:742.

Sendmail[1] is a widely used Mail Transfer Agent (MTA).

Michal Zalewski reported[2] a remote vulnerability[3] in sendmail
versions 8.12.9 and earlier. The problem resides in the address
parsing code and can be exploited to execute arbitrary code in the
context of the server. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CVE-2003-0694 to this
issue[4].

The sendmail authors have released a new version[5], 8.12.10, which
fixes this vulnerability. They have also made available a patch[6]
for older versions, which the packages provided via this announcement
contain.

This update also includes fixes for a buffer overflow vulnerability
in the ruleset parsing code. This vulnerability is not exploitable in
the default configuration and requires the use of non-standard
rulesets recipients. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2003-0681 to this
issue[7].

Starting with Conectiva Linux 7.0, sendmail is no longer the default
mail server and has been replaced with Postfix (but sendmail is still
shipped with all Conectiva Linux versions).


Solution:
The apt tool can be used to perform RPM package upgrades
by running 'apt-get update' followed by 'apt-get upgrade'

http://www.sendmail.org/
http://www.securityfocus.com/archive/1/337839
http://www.kb.cert.org/vuls/id/784980
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0694
http://www.sendmail.org/8.12.10.html
http://www.sendmail.org/parse8.359.2.8.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0681
http://www.securityspace.com/smysecure/catid.html?in=CLA-2003:742
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003

Risk factor : Critical
Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2003-0694
Bugtraq: 20030917 Sendmail 8.12.9 prescan bug (a new one) [CAN-2003-0694] (Google Search)
http://marc.theaimsgroup.com/?l=bugtraq&m=106381604923204&w=2
http://archives.neohapsis.com/archives/fulldisclosure/2003-q3/4119.html
http://archives.neohapsis.com/archives/vulnwatch/2003-q3/0113.html
http://www.cert.org/advisories/CA-2003-25.html
http://www.redhat.com/support/errata/RHSA-2003-283.html
http://www.redhat.com/support/errata/RHSA-2003-284.html
Conectiva Linux advisory: CLA-2003:742
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000742
Immunix Linux Advisory: IMNX-2003-7+-021-01
http://www.mandriva.com/security/advisories?name=MDKSA-2003:092
Debian Security Information: DSA-384 (Google Search)
http://www.debian.org/security/2003/dsa-384
FreeBSD Security Advisory: FreeBSD-SA-03:13
HPdes Security Advisory: SSRT3631
SCO Security Bulletin: CSSA-2003-036.0
SCO Security Bulletin: SCOSA-2004.11
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.11/SCOSA-2004.11.txt
Bugtraq: 20030917 GLSA: sendmail (200309-13) (Google Search)
http://marc.theaimsgroup.com/?l=bugtraq&m=106383437615742&w=2
Bugtraq: 20030917 [slackware-security] Sendmail vulnerabilities fixed (SSA:2003-260-02) (Google Search)
http://marc.theaimsgroup.com/?l=bugtraq&m=106382859407683&w=2
Bugtraq: 20030919 [OpenPKG-SA-2003.041] OpenPKG Security Advisory (sendmail) (Google Search)
http://marc.theaimsgroup.com/?l=bugtraq&m=106398718909274&w=2
CERT/CC vulnerability note: VU#784980
http://www.kb.cert.org/vuls/id/784980
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:572
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:603
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:2975
Common Vulnerability Exposure (CVE) ID: CVE-2003-0681
CERT/CC vulnerability note: VU#108964
http://www.kb.cert.org/vuls/id/108964
BugTraq ID: 8649
http://www.securityfocus.com/bid/8649
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:595
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:3606
XForce ISS Database: sendmail-ruleset-parsing-bo(13216)
http://xforce.iss.net/xforce/xfdb/13216
CopyrightCopyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 39337 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2014 E-Soft Inc. All rights reserved.