Er is een "remotely exploitable" lek in Sendmail ontdekt. Het probleem zit hem in de prescan() functie, maar is niet gerelateerd aan eerdere problemen met die code. Hieronder staat het volledige bericht:

The primary attack vector is an indirect invocation via parseaddr(),
although other routes are possible. Heap or stack structures, depending on the calling location, can be overwritten due to the ability to go past end of the input buffer in strtok()-alike routines.

This is an early release, thanks to my sheer stupidity.

--------------

Attack details

--------------

Local exploitation on little endian Linux is confirmed to be trivial
via recipient.c and sendtolist(), with a pointer overwrite leading to a neat case of free() on user-supplied data, i.e.:

eip = 0x40178ae2

edx = 0x41414141

esi = 0x61616161

SEGV in chunk_free (ar_ptr=0x4022a160, p=0x81337e0) at malloc.c:3242

0x40178ae2 : mov %esi,0xc(%edx)

0x40178ae5 : mov %edx,0x8(%esi)

Remote attack is believed to be possible.

----------------

Workaround / fix

----------------

Vendor was notified, and released an early patch attached below.
There are no known workarounds.

Index: parseaddr.c


===================================================================


RCS file: /cvs/src/gnu/usr.sbin/sendmail/sendmail/parseaddr.c,v

retrieving revision 1.16


diff -u -r1.16 parseaddr.c


--- parseaddr.c 29 Mar 2003 19:44:01 -0000      1.16

+++ parseaddr.c 16 Sep 2003 17:37:26 -0000

@@ -700,7 +700,11 @@

                                                addr[MAXNAME] = '';

        returnnull:

                                        if (delimptr != NULL)

+                                       {

+                                               if (p > addr)

+                                                       p--;

                                                *delimptr = p;

+                                       }

                                        CurEnv->e_to = saveto;

                                        return NULL;

                                }