CVE-2006-4434: Use After Free
Use-after-free vulnerability in Sendmail before 8.13.8 allows remote attackers to cause a denial of service (crash) via a long "header line", which causes a previously freed variable to be referenced. NOTE: the original developer has disputed the severity of this issue, saying "The only denial of service that is possible here is to fill up the disk with core dumps if the OS actually generates different core dumps (which is unlikely)... the bug is in the shutdown code (finis()) which leads directly to exit(3), i.e., the process would terminate anyway, no mail delivery or receiption is affected."
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-4434?
CVE-2006-4434 has been assessed as a denial of service vulnerability, which can lead to a crash of the Sendmail service.
How do I fix CVE-2006-4434?
To address CVE-2006-4434, you should upgrade Sendmail to version 8.13.8 or later.
What versions of Sendmail are affected by CVE-2006-4434?
CVE-2006-4434 affects Sendmail versions prior to 8.13.8, including 8.13.7, 8.13.6, and earlier versions.
Can CVE-2006-4434 be exploited remotely?
Yes, CVE-2006-4434 can be exploited remotely, allowing attackers to send specially crafted header lines to trigger the vulnerability.
What happens if I do not address CVE-2006-4434?
If CVE-2006-4434 is not addressed, it may leave your Sendmail service vulnerable to crashes and disrupt email communications.