CVE-1999-0203: Critical severity Eric Allman Sendmail vulnerability
In Sendmail, attackers can gain root privileges via SMTP by specifying an improper "mail from" address and an invalid "rcpt to" address that would cause the mail to bounce to a program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure Sendmail to validate and enforce proper SMTP envelope 'mail from' addresses and reject malformed or forged sender addresses.
Sendmail envelope_mail_from_validation = reject_malformed - Configuration
Configure Sendmail to reject invalid 'rcpt to' addresses that would cause a bounce to be delivered to a program; disable or restrict bounce delivery that invokes programs or piping.
Sendmail reject_rcpt_to_bouncing_to_programs = true - Compensating control
Restrict access to the SMTP service (e.g., port 25) to trusted hosts or networks using firewall rules or ACLs to reduce exposure to remote SMTP-based exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0203?
CVE-1999-0203 is considered a high severity vulnerability due to the potential for attackers to gain root privileges.
How do I fix CVE-1999-0203?
To fix CVE-1999-0203, upgrade Sendmail to version 8.6.11 or later, which addresses the vulnerability.
What kind of vulnerability is CVE-1999-0203?
CVE-1999-0203 is an improper input validation vulnerability in Sendmail that allows privilege escalation.
Which versions of Sendmail are affected by CVE-1999-0203?
The affected version is Sendmail 8.6.10; earlier and some subsequent versions may also be impacted if not patched.
What is the impact of exploiting CVE-1999-0203?
Exploiting CVE-1999-0203 can allow an attacker to execute arbitrary commands with root privileges, compromising system security.