[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    Re: [Full-Disclosure] sendmail vunerability?
From:       Timo Sirainen <tss () iki ! fi>
Date:       2003-03-29 7:52:29
[Download RAW message or body]

On Wed, 2003-11-19 at 14:55, nag wrote:
> there is some rumor spreading about new sendmail vulnerability. i do not see
> any news at www.sendmail.org but supposedly ths is remote buffer overflow.
> i received the patch (see below), but o not have any exploit, so please
> don't mail me about it.
> 
> does this look legitimate? any comments? is this something old? is
> this some scam backdoor?

Assuming the address can contain high-ascii characters and it can be
more than twice as long as pvpbsize, this is exploitable. I don't know
if those conditions are prevented anywhere. Pretty interesting hole
anyway, took a while to figure it out.

Another problem may be that it calls isspace() and isascii() for
negative values. Some systems don't like that.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
[prev in list] [next in list] [prev in thread] [next in thread]