Vulnerability: Sendmail DNS Map TXT Record Buffer Overflow
Sendmail is a freely available, open source mail transport agent. It is available for most Unix and Linux operating systems.
A buffer overflow in the DNS handling code of Sendmail has been discovered. Sendmail attempting to map an address using a TXT query type does not properly check bounds on data returned from the nameserver. Because of this, a malicious nameserver could send a string of arbitrary length to the mail server, resulting in a buffer overflow, and potential code execution.
The Sendmail Consortium has stated that the possibility of exploitation is relatively low, as there are no known configurations that use this DNS map option.
Remote: Yes
Exploit: No
Solution: Fixes are available.
Sendmail Consortium Sendmail 8.11:
Sendmail Consortium Upgrade sendmail.8.12.5.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/....8.12.5.tar.gz
Sendmail Consortium Sendmail 8.11.1:
Sendmail Consortium Upgrade sendmail.8.12.5.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/....8.12.5.tar.gz
Sendmail Consortium Sendmail 8.11.2:
Sendmail Consortium Upgrade sendmail.8.12.5.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/....8.12.5.tar.gz
Sendmail Consortium Sendmail 8.11.3:
Sendmail Consortium Upgrade sendmail.8.12.5.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/....8.12.5.tar.gz
Sendmail Consortium Sendmail 8.11.4:
Sendmail Consortium Upgrade sendmail.8.12.5.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/....8.12.5.tar.gz
Sendmail Consortium Sendmail 8.11.5:
Sendmail Consortium Upgrade sendmail.8.12.5.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/....8.12.5.tar.gz
Sendmail Consortium Sendmail 8.11.6:
Sendmail Consortium Upgrade sendmail.8.12.5.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/....8.12.5.tar.gz
Sendmail Consortium Sendmail 8.12:
Sendmail Consortium Upgrade sendmail.8.12.5.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/....8.12.5.tar.gz
Sendmail Consortium Sendmail 8.12.1:
Sendmail Consortium Upgrade sendmail.8.12.5.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/....8.12.5.tar.gz
Sendmail Consortium Sendmail 8.12.2:
Sendmail Consortium Upgrade sendmail.8.12.5.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/....8.12.5.tar.gz
Sendmail Consortium Sendmail 8.12.3:
Sendmail Consortium Upgrade sendmail.8.12.5.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/....8.12.5.tar.gz
Sendmail Consortium Sendmail 8.12.4:
Sendmail Consortium Upgrade sendmail.8.12.5.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/....8.12.5.tar.gz
