CVE-2014-3956: Infoleak
The smcloseonexec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FDCLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3956?
CVE-2014-3956 has a medium severity level due to its ability to allow local users access to unintended file descriptors.
How do I fix CVE-2014-3956?
To fix CVE-2014-3956, upgrade Sendmail to version 8.14.9 or later.
Who is affected by CVE-2014-3956?
CVE-2014-3956 affects users of Sendmail versions prior to 8.14.9 running on specific operating systems like FreeBSD and HP-UX.
What is the impact of CVE-2014-3956?
The impact of CVE-2014-3956 allows local users to access unintended high-numbered file descriptors through a custom mail delivery program.
Is there a workaround for CVE-2014-3956?
There is no official workaround for CVE-2014-3956; upgrading to the patched version is the recommended action.