CVE-2003-0161: Buffer Overflow
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sendmailto a version that resolves this vulnerability.Fixed in 8.12.9
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0161?
The severity of CVE-2003-0161 is considered high, as it allows remote attackers to exploit the vulnerability and potentially execute arbitrary code.
How do I fix CVE-2003-0161?
To fix CVE-2003-0161, update Sendmail to version 8.12.9 or later, which addresses the vulnerability.
Which versions of Sendmail are affected by CVE-2003-0161?
CVE-2003-0161 affects multiple Sendmail versions, specifically those prior to 8.12.9.
Can CVE-2003-0161 be exploited by attackers?
Yes, CVE-2003-0161 can be exploited by attackers who send specially crafted email, leading to potential denial of service or code execution.
Is there a workaround for CVE-2003-0161?
A temporary workaround for CVE-2003-0161 includes disabling unused Sendmail features or implementing strict input validation.