CVE-2000-0319: Medium severity Eric Allman Sendmail vulnerability
mail.local in Sendmail 8.10.x does not properly identify the .\n string which identifies the end of message text, which allows a remote attacker to cause a denial of service or corrupt mailboxes via a message line that is 2047 characters long and ends in .\n.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
sendmail/mail.localfrom your environment.If mail.local is not required, uninstall or disable the mail.local delivery agent to eliminate the vulnerable component (prevents mail.local from processing incoming messages).
- Compensating control
Restrict remote access to the Sendmail SMTP service (TCP port 25) at the network perimeter or host firewall so only trusted systems can submit mail, reducing exposure to remote attackers.
- Compensating control
Deploy or configure a mail gateway/proxy or SMTP filter to reject or normalize incoming message lines that are 2047 characters long (or otherwise unusually long) and to correctly enforce end-of-message markers (e.g., the ".\n" terminator) before passing messages to Sendmail/mail.local.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0319?
The severity of CVE-2000-0319 is considered moderate due to the possibility of denial of service or mailbox corruption.
How do I fix CVE-2000-0319?
To fix CVE-2000-0319, upgrade to a version of Sendmail that is not affected, such as 8.10.0 or later.
What versions of Sendmail are affected by CVE-2000-0319?
CVE-2000-0319 affects Sendmail versions 8.6.x to 8.9.x and some 8.7.x versions.
What type of attack does CVE-2000-0319 enable?
CVE-2000-0319 enables a remote attacker to cause a denial of service or corrupt mailboxes.
Is CVE-2000-0319 still a risk for current systems?
CVE-2000-0319 is a historical vulnerability, but systems still using old affected versions of Sendmail remain at risk.