ID SENDMAIL_MIME_OVERFLOW2.NASL Type nessus Reporter This script is Copyright (C) 2002-2018 and is owned by Tenable, Inc. or an Affiliate thereof. Modified 2021-01-02T00:00:00
Description
The remote Sendmail server, according to its version number, may be
vulnerable to a MIME conversion overflow attack which allows anyone to
execute arbitrary commands as root.
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(10055);
script_version("1.21");
script_cvs_date("Date: 2018/09/17 21:46:53");
script_cve_id("CVE-1999-0047");
script_bugtraq_id(685);
script_name(english:"Sendmail < 8.8.5 MIME Conversion Malformed Header Overflow");
script_summary(english:"Checks Sendmail version number");
script_set_attribute(attribute:"synopsis", value:
"Arbitrary code may be run on the remote host.");
script_set_attribute(attribute:"description", value:
"The remote Sendmail server, according to its version number, may be
vulnerable to a MIME conversion overflow attack which allows anyone to
execute arbitrary commands as root.");
script_set_attribute(attribute:"solution", value:
"Upgrade to Sendmail 8.8.5 or later.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-1999-0047");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"1997/01/01");
script_set_attribute(attribute:"plugin_publication_date", value:"2002/07/25");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/a:sendmail:sendmail");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2002-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"SMTP problems");
script_dependencies("sendmail_detect.nbin");
script_require_keys("installed_sw/Sendmail");
exit(0);
}
include("vcf.inc");
app_info = vcf::get_app_info(app:"Sendmail");
constraints = [{ "fixed_version" : "8.8.5" }];
vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);
{"id": "SENDMAIL_MIME_OVERFLOW2.NASL", "bulletinFamily": "scanner", "title": "Sendmail < 8.8.5 MIME Conversion Malformed Header Overflow", "description": "The remote Sendmail server, according to its version number, may be\nvulnerable to a MIME conversion overflow attack which allows anyone to\nexecute arbitrary commands as root.", "published": "2002-07-25T00:00:00", "modified": "2021-01-02T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "href": "https://www.tenable.com/plugins/nessus/10055", "reporter": "This script is Copyright (C) 2002-2018 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": [], "cvelist": ["CVE-1999-0047"], "type": "nessus", "lastseen": "2021-01-01T05:32:39", "edition": 26, "viewCount": 1, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-1999-0047"]}, {"type": "osvdb", "idList": ["OSVDB:9309"]}], "modified": "2021-01-01T05:32:39", "rev": 2}, "score": {"value": 8.0, "vector": "NONE", "modified": "2021-01-01T05:32:39", "rev": 2}, "vulnersScore": 8.0}, "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(10055);\n script_version(\"1.21\");\n script_cvs_date(\"Date: 2018/09/17 21:46:53\");\n\n script_cve_id(\"CVE-1999-0047\");\n script_bugtraq_id(685);\n\n script_name(english:\"Sendmail < 8.8.5 MIME Conversion Malformed Header Overflow\");\n script_summary(english:\"Checks Sendmail version number\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Arbitrary code may be run on the remote host.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote Sendmail server, according to its version number, may be\nvulnerable to a MIME conversion overflow attack which allows anyone to\nexecute arbitrary commands as root.\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Sendmail 8.8.5 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-1999-0047\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"1997/01/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2002/07/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:sendmail:sendmail\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2002-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SMTP problems\");\n\n script_dependencies(\"sendmail_detect.nbin\");\n script_require_keys(\"installed_sw/Sendmail\");\n exit(0);\n}\n\ninclude(\"vcf.inc\");\n\napp_info = vcf::get_app_info(app:\"Sendmail\");\n\nconstraints = [{ \"fixed_version\" : \"8.8.5\" }];\n\nvcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);\n", "naslFamily": "SMTP problems", "pluginID": "10055", "cpe": ["cpe:/a:sendmail:sendmail"], "scheme": null, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}
{"cve": [{"lastseen": "2020-10-03T11:36:54", "description": "MIME conversion buffer overflow in sendmail versions 8.8.3 and 8.8.4.", "edition": 3, "cvss3": {}, "published": "1997-01-28T05:00:00", "title": "CVE-1999-0047", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-1999-0047"], "modified": "2008-09-09T12:33:00", "cpe": ["cpe:/a:eric_allman:sendmail:8.8.4", "cpe:/o:bsdi:bsd_os:2.1", "cpe:/o:caldera:openlinux:1.0", "cpe:/a:eric_allman:sendmail:8.8.3"], "id": "CVE-1999-0047", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-1999-0047", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:o:caldera:openlinux:1.0:*:*:*:*:*:*:*", "cpe:2.3:a:eric_allman:sendmail:8.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:eric_allman:sendmail:8.8.4:*:*:*:*:*:*:*", "cpe:2.3:o:bsdi:bsd_os:2.1:*:*:*:*:*:*:*"]}], "osvdb": [{"lastseen": "2017-04-28T13:20:04", "bulletinFamily": "software", "cvelist": ["CVE-1999-0047"], "edition": 1, "description": "## Solution Description\nUpgrade to version 8.8.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## References:\nMail List Post: http://seclists.org/lists/bugtraq/1997/Jan/0061.html\nISS X-Force ID: 1835\n[CVE-1999-0047](https://vulners.com/cve/CVE-1999-0047)\nCERT: CA-1997-05\nBugtraq ID: 685\n", "modified": "1997-01-01T00:00:00", "published": "1997-01-01T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:9309", "id": "OSVDB:9309", "title": "Sendmail MIME Conversion Malformed Header Overflow", "type": "osvdb", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}
