CVE-1999-0976: Low severity Eric Allman Sendmail vulnerability
Sendmail allows local users to reinitialize the aliases database via the newaliases command, then cause a denial of service by interrupting Sendmail.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict who can run the newaliases command so that only trusted/privileged system administrators can execute it (for example, remove execute permission for unprivileged accounts or place the binary in a root-only directory).
Sendmail newaliases access = restricted to privileged users - Compensating control
Prevent unprivileged local users from interrupting the sendmail process (which can cause the denial of service). Ensure sendmail runs under an appropriate account and that only the process owner or root can send signals to it; apply local access controls or host-based policies to block unprivileged users from killing or interrupting the sendmail process.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0976?
CVE-1999-0976 is classified as a denial-of-service vulnerability that can impact the availability of the Sendmail service.
How do I fix CVE-1999-0976?
To mitigate CVE-1999-0976, ensure that Sendmail is updated to a secure version that addresses this vulnerability.
Who is affected by CVE-1999-0976?
Local users with access to execute the newaliases command can trigger the vulnerability associated with CVE-1999-0976.
What impact does CVE-1999-0976 have on systems?
CVE-1999-0976 can lead to a denial of service by disrupting Sendmail operations when reinitializing the aliases database.
What versions of Sendmail are affected by CVE-1999-0976?
CVE-1999-0976 primarily affects Sendmail version 8.9.3.