CVE-2003-0688: Medium severity redhat Sendmail vulnerability

Published Sep 3, 2003

Updated

The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect data.

Affected Software

26 affected components

redhat Sendmail=8.12.5-7

redhat Sendmail=8.12.8-4

Sendmail Sendmail=8.12.1

Sendmail Sendmail=8.12.2

Sendmail Sendmail=8.12.3

Sendmail Sendmail=8.12.4

Sendmail Sendmail=8.12.5

Sendmail Sendmail=8.12.6

Sendmail Sendmail=8.12.7

Sendmail Sendmail=8.12.8

SGI IRIX=6.5.19

SGI IRIX=6.5.20

SGI IRIX=6.5.21

Compaq Tru64=5.0a

Compaq Tru64=5.1

FreeBSD FreeBSD=4.6

FreeBSD FreeBSD=4.7

FreeBSD FreeBSD=4.8

FreeBSD FreeBSD=5.0

OpenBSD OpenBSD=3.2

Remediation

Patch Available

http://www.redhat.com/support/errata/RHSA-2003-265.html

Event History

Sep 3, 2003

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Oct 20, 2003

Data Sourced

via NVD·04:00 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2003-0688?

CVE-2003-0688 has been classified as critical due to its potential to cause denial of service by crashing the Sendmail process.

How do I fix CVE-2003-0688?

To fix CVE-2003-0688, update Sendmail to version 8.12.9 or later, which addresses this vulnerability.

Which versions of Sendmail are affected by CVE-2003-0688?

CVE-2003-0688 affects Sendmail versions 8.12.8 and earlier.

What type of attack does CVE-2003-0688 enable?

CVE-2003-0688 enables remote attackers to cause Sendmail to crash, resulting in a denial of service.

Is CVE-2003-0688 related to DNS responses?

Yes, CVE-2003-0688 is triggered by invalid DNS responses due to improper initialization in the DNS map code.