Vulnerability Intelligence Report
CVE-2003-0161
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
No Active Exploit Signals
CVSS Base Score
10.0
HIGH
EPSS Probability:38.19%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| sendmail | sendmail | 2.6, 2.6.1, 2.6.2, 3.0, 3.0.1, 3.0.2, 3.0.3, 8.9.0, 8.9.1, 8.9.2, 8.9.3, 8.10, 8.10.1, 8.10.2, 8.11.0, 8.11.1, 8.11.2, 8.11.3, 8.11.4, 8.11.5, 8.11.6, 8.12, 8.12.0, 8.12.1, 8.12.2, 8.12.3, 8.12.4, 8.12.5, 8.12.6, 8.12.7, 8.12.8 |
| sendmail | sendmail_switch | 2.1, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.2, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 3.0, 3.0.1, 3.0.2, 3.0.3 |
| compaq | tru64 | 4.0b, 4.0d, 4.0d_pk9_bl17, 4.0f, 4.0f_pk6_bl17, 4.0f_pk7_bl18, 4.0g, 4.0g_pk3_bl17, 5.0, 5.0_pk4_bl17, 5.0_pk4_bl18, 5.0a, 5.0a_pk3_bl17, 5.0f, 5.1, 5.1_pk3_bl17, 5.1_pk4_bl18, 5.1_pk5_bl19, 5.1_pk6_bl20, 5.1a, 5.1a_pk1_bl1, 5.1a_pk2_bl2, 5.1a_pk3_bl3, 5.1b, 5.1b_pk1_bl1 |
| hp | hp-ux | 10.00, 10.01, 10.08, 10.09, 10.10, 10.16, 10.20, 10.24, 10.26, 10.30, 10.34, 11.00, 11.0.4, 11.11, 11.20, 11.22 |
| hp | hp-ux_series_700 | 10.20 |
| hp | hp-ux_series_800 | 10.20 |
| hp | sis | all |
| sun | solaris | 2.4, 2.5, 2.5.1, 2.6, 7.0, 8.0, 9.0 |
| sun | sunos | 5.4, 5.5, 5.5.1, 5.7, 5.8 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
38.188%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2003-03-24T00:00:00 |
| Published | 2003-04-01T05:00:00 |
| Patch Date | 2003-03-29 |
| Last Updated | 2024-08-08T01:43:36 |
Community Chatter & Buzz