sendmail smrsh bypass vulnerability [LWN.net]

Package(s): sendmail CVE #(s): CAN-2002-1165

Created: October 2, 2002 Updated: November 29, 2002

Description: iDEFENSE has posted an advisory warning of a couple of ways of bypassing the restrictions imposed by the sendmail "smrsh" utility. smrsh puts limits on which programs a user may run out of a .forward file; this vulnerability could give a local user undesired access to the mail server system. A patch has been made available from sendmail.org which closes the vulnerability.

Alerts:

Mandrake	MDKSA-2002:083	2002-11-28
SCO Group	CSSA-2002-052.0	2002-11-21
Conectiva	CLA-2002:532	2002-10-16
Gentoo	sendmail-20021013	2002-10-13

(Log in to post comments)