Sendmail flaw puts systems at risk, again

Systems running sendmail are at risk of hacker attacks because of a flaw in the way the commonly used e-mail server software handles long e-mail addresses, experts warned Saturday. This second serious bug announced this month has some sendmail users looking for alternatives.

Sendmail does not adequately check the length of e-mail addresses. An e-mail message with a specially crafted address can trigger a stack overflow, potentially allowing an attacker to gain control of a vulnerable sendmail server, the CERT Coordination Center warned in an advisory Saturday. (http://www.cert.org/advisories/CA-2003-12.html)

Sendmail servers that aren't directly connected to the Internet are also at risk, since the vulnerability is triggered by the contents of a malicious e-mail message that can be handed on from server to server, CERT said.

Many vendors distribute vulnerable versions of sendmail and users should check with their vendors for a security patch, CERT said. Sendmail is the most commonly used MTA (mail transfer agent) and handles the majority of all Internet e-mail traffic.

Sendmail Inc. and the Sendmail Consortium urge users of their versions to upgrade to sendmail 8.12.9 or apply a patch, they said in a joint advisory Saturday. The Sendmail Consortium develops an open source version of sendmail that is distributed with both free and commercial operating systems. Sendmail Inc. sells a commercial product based on the open source sendmail software.

The problem affects all versions of Sendmail Pro, all versions of open source sendmail prior to 8.12.9, and several versions of Sendmail Switch and Sendmail for NT, according to CERT.

The e-mail address parser flaw is the second "critical" bug in sendmail announced and patched this month. The earlier vulnerability occurred because of an error in a function that checks whether addresses in the e-mail message header are valid. This could also allow an attacker to take over a sendmail server, experts said.

Some users have had it with sendmail, according to postings on the topic on "News for nerds" Web site Slashdot.org.

"This is the straw that breaks the camel's back. I'm changing to another MTA," writes one user. "Sendmail: The IIS of Open Source," writes another, referring to Microsoft Corp.'s Internet Information Server (IIS) Web server software, which has had its share of security issues.

However, other forum postings criticize qmail and Postfix, two sendmail alternatives, and point out that this latest sendmail flaw is likely difficult to exploit.

CERT said it successfully exploited the flaw to knock the sendmail server offline and that it is possible to execute code on some systems by exploiting this flaw.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Joris Evers

IDG News Service
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?