CVE-1999-1580: High severity Sendmail Sendmail vulnerability
SunOS sendmail 5.59 through 5.65 uses popen to process a forwarding host argument, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable and passing crafted values to the -oR option.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
SunOS sendmailfrom your environment.Uninstall or remove sendmail from systems where it is not required to eliminate the vulnerable component.
- Configuration
Disable or prevent use of the -oR option (the forwarding-host argument) so sendmail does not process forwarding hosts via popen. Remove or block any invocation of -oR in configuration files and startup scripts until a vendor patch is available.
SunOS sendmail -oR forwarding host processing = disabled - Compensating control
Restrict which local accounts can execute the sendmail binary (for example, adjust file permissions, use local access controls, or restrict execution to a trusted administrative group) to prevent unprivileged local users from invoking sendmail with the -oR option.
- Operational
If you suspect the vulnerability has been exploited (local privilege escalation to root), rebuild or restore affected systems from trusted media and rotate any credentials/keys that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1580?
CVE-1999-1580 has a high severity due to the potential for local users to gain root privileges.
How do I fix CVE-1999-1580?
To fix CVE-1999-1580, upgrade to a later version of Sendmail that does not use popen to process the -oR option.
Which versions of Sendmail are affected by CVE-1999-1580?
Sendmail versions 5.59, 5.61, and 5.65 are affected by CVE-1999-1580.
Can CVE-1999-1580 be exploited remotely?
No, CVE-1999-1580 can only be exploited by local users on the system.
What systems are vulnerable to CVE-1999-1580?
SunOS versions 4.1.1 through 4.1.4 and Sendmail versions 5.59 to 5.65 are vulnerable to CVE-1999-1580.