Published: 07/06/2006 Updated: 18/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Subscribe to Sendmail

Sendmail prior to 8.13.7 allows remote malicious users to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sendmail sendmail 8.10.1
sendmail sendmail 8.10.2
sendmail sendmail 8.11.6
sendmail sendmail 8.11.7
sendmail sendmail 8.12.4
sendmail sendmail 8.12.5
sendmail sendmail 8.12
sendmail sendmail 8.9.2
sendmail sendmail 8.9.3
sendmail sendmail 8.11.0
sendmail sendmail 8.11.1
sendmail sendmail 8.12.0
sendmail sendmail 8.12.1
sendmail sendmail 8.12.6
sendmail sendmail 8.12.7
sendmail sendmail 8.12.8
sendmail sendmail 8.13.3
sendmail sendmail 8.13.4
sendmail sendmail 8.13.0
sendmail sendmail 8.13.1
sendmail sendmail 8.10
sendmail sendmail 8.11.4
sendmail sendmail 8.11.5
sendmail sendmail 8.12.2
sendmail sendmail 8.12.3
sendmail sendmail 8.9.0
sendmail sendmail 8.9.1
sendmail sendmail
sendmail sendmail 8.11.2
sendmail sendmail 8.11.3
sendmail sendmail 8.12.10
sendmail sendmail 8.12.11
sendmail sendmail 8.12.9
sendmail sendmail 8.13.5
sendmail sendmail 8.8.8
sendmail sendmail 8.13.1.2
sendmail sendmail 8.13.2

Debian Bug report logs - #373801 sendmail: malformed MIME message leads to potential denial of service (CVE-2006-1173) Package: sendmail; Maintainer for sendmail is Debian QA Group <packages@qadebianorg>; Source for sendmail is src:sendmail (PTS, buildd, popcon) Reported by: Joost van Baal <jevanbaal+debian-bugs-20060 ...

It turned out that the sendmail binary depends on libsasl2 (>= 2119dfsg1) which is neither available in the stable nor in the security archive This version is scheduled for the inclusion in the next update of the stable release, though You'll have to download the referenced file for your architecture from below and install it with dpkg -i ...

CWE-399 http://www.kb.cert.org/vuls/id/146718 http://secunia.com/advisories/20473 http://www.sendmail.com/security/advisories/SA-200605-01.txt.asc http://www.redhat.com/support/errata/RHSA-2006-0515.html http://sunsolve.sun.com/search/document.do?assetkey=1-26-102460-1 http://www.securityfocus.com/bid/18433 http://securitytracker.com/id?1016295 http://secunia.com/advisories/15779 http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-18.html http://www-1.ibm.com/support/search.wss?rs=0&q=IY85415&apar=only http://www-1.ibm.com/support/search.wss?rs=0&q=IY85930&apar=only ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:17.sendmail.asc http://www.gentoo.org/security/en/glsa/glsa-200606-19.xml http://www.openbsd.org/errata38.html#sendmail2 ftp://patches.sgi.com/support/free/security/advisories/20060601-01-P http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.631382 http://lists.suse.com/archive/suse-security-announce/2006-Jun/0006.html http://secunia.com/advisories/20641 http://secunia.com/advisories/20650 http://secunia.com/advisories/20651 http://secunia.com/advisories/20654 http://secunia.com/advisories/20673 http://secunia.com/advisories/20675 http://secunia.com/advisories/20679 http://secunia.com/advisories/20683 http://secunia.com/advisories/20684 http://secunia.com/advisories/20694 ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc http://secunia.com/advisories/20726 http://secunia.com/advisories/20782 http://www.f-secure.com/security/fsc-2006-5.shtml http://secunia.com/advisories/21042 https://issues.rpath.com/browse/RPL-526 http://secunia.com/advisories/21160 http://secunia.com/advisories/21327 http://www.debian.org/security/2006/dsa-1155 http://secunia.com/advisories/21612 http://support.avaya.com/elmodocs2/security/ASA-2006-148.htm http://www.osvdb.org/26197 http://secunia.com/advisories/21647 http://www.mandriva.com/security/advisories?name=MDKSA-2006:104 http://www.vupen.com/english/advisories/2006/2389 http://www.vupen.com/english/advisories/2006/2390 http://www.vupen.com/english/advisories/2006/3135 http://www.vupen.com/english/advisories/2006/2189 http://itrc.hp.com/service/cki/docDisplay.do?docId=c00692635 http://www.vupen.com/english/advisories/2006/2351 http://www.vupen.com/english/advisories/2006/2798 http://www.vupen.com/english/advisories/2006/2388 https://exchange.xforce.ibmcloud.com/vulnerabilities/27128 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11253 http://www.securityfocus.com/archive/1/442939/100/0/threaded http://www.securityfocus.com/archive/1/440744/100/0/threaded http://www.securityfocus.com/archive/1/438330/100/0/threaded http://www.securityfocus.com/archive/1/438241/100/0/threaded http://www.securityfocus.com/archive/1/437928/100/0/threaded https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=373801 https://nvd.nist.gov https://www.kb.cert.org/vuls/id/146718

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook