CVE-2003-0161

2003-04-0205:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

sendmail

buffer overflow

prescan()

cve-2003-0161

nvd

7.5 High

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.172 Low

EPSS

Percentile

96.1%

JSON

The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special “NOCHAR” control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.

CPENameOperatorVersion
sendmail:sendmail_switchsendmail sendmail switcheq2.1.2
sendmail:sendmail_switchsendmail sendmail switcheq3.0.2
sendmail:sendmail_switchsendmail sendmail switcheq2.2.2
sendmail:sendmailsendmaileq2.6.2
sendmail:sendmailsendmaileq8.9.2
sendmail:sendmail_switchsendmail sendmail switcheq2.1.1
sendmail:sendmailsendmaileq8.11.4
sendmail:sendmailsendmaileq8.12
sendmail:sendmailsendmaileq2.6
sendmail:sendmailsendmaileq8.11.1

CPE	Name	Operator	Version
sendmail:sendmail_switch	sendmail sendmail switch	eq	2.1.2
sendmail:sendmail_switch	sendmail sendmail switch	eq	3.0.2
sendmail:sendmail_switch	sendmail sendmail switch	eq	2.2.2
sendmail:sendmail	sendmail	eq	2.6.2
sendmail:sendmail	sendmail	eq	8.9.2
sendmail:sendmail_switch	sendmail sendmail switch	eq	2.1.1
sendmail:sendmail	sendmail	eq	8.11.4
sendmail:sendmail	sendmail	eq	8.12
sendmail:sendmail	sendmail	eq	2.6
sendmail:sendmail	sendmail	eq	8.11.1