CVE-1999-0130

CVE-1999-0130 affects Sendmail 8.7.x and 8.8.x, where a local user can start the SMTP daemon in daemon mode and obtain root privileges. Multiple connected sources corroborate: OpenVAS notes local overflow in Sendmail 8.7.x/8.8.x with daemon-mode enablement; Nessus entries describe local privilege...

CVE-1999-0206

CVE-1999-0206 describes a MIME buffer overflow in Sendmail versions 8.8.0 and 8.8.1 that can give root access. Connected documents corroborate: Red Hat and Nessus sources note a MIME processing overflow affecting those versions with root access consequences, and a remediation suggested is to upgr...

CVE-1999-0095

CVE-1999-0095 involves the Sendmail MTA where the DEBUG command is enabled, enabling remote users to execute arbitrary commands as root. Public sources (NVD/Nessus/OpenVAS/Red Hat/CIRCL) confirm that the issue allows full root access via the DEBUG/WIZ mechanism, with assessments placing the impac...

CVE-1999-0129

Sendmail allows local users to write to a file and gain group permissions via a .forward or :include: file...

CVE-1999-0204

Sendmail 8.6.9 allows remote attackers to execute root commands, using ident...

rootcron.txt

!/bin/sh clear echo '------------------------------------------------------------------' echo 'Marchew Hyperreal Industries ' echo 'Stumilowy Las Team ' echo '---------------------------- presents ----------------------------' echo echo ' -= vixie-cron root sploit by Michal Zalewski =-' echo echo...

Sendmail decode Alias Arbitrary File Overwrite

The remote SMTP server seems to pipe mail sent to the 'decode' alias to a program. There have been in the past a lot of security problems regarding this, as it would allow an attacker to overwrite arbitrary files on the remote server. We suggest you deactivate this alias. C Tenable Network...

Sendmail RCPT TO Command Arbitrary File Overwrite

The remote SMTP server did not complain when issued the command : MAIL FROM: root@thishost RCPT TO: /tmp/nessustest This probably means that it is possible to send mail directly to files, which is a serious threat, since this allows anyone to overwrite any file on the remote server. This security...

CVE-1999-0769

Vixie Cron on Linux systems allows local users to set parameters of sendmail commands via the MAILTO environmental variable...

Caldera OpenLinux 2.2 Debian 2.12.2 RedHat 6.0 - Vixie Cron MAILTO Sendmail

Caldera OpenLinux 2.2 Debian 2.12.2 RedHat 6.0 - Vixie Cron MAILTO Sendmail Caldera OpenLinux 2.2 ,Debian Linux 2.1/2.2,RedHat Linux = 6.0 Vixie Cron MAILTO Sendmail Vulnerability source: https://www.securityfocus.com/bid/611/info Failure by the vixie cron daemon from validating the contents of a...

Caldera OpenLinux 2.2 / Debian 2.1/2.2 / RedHat 6.0 - Vixie Cron MAILTO Sendmail

Caldera OpenLinux 2.2 ,Debian Linux 2.1/2.2,RedHat Linux = 6.0 Vixie Cron MAILTO Sendmail Vulnerability source: https://www.securityfocus.com/bid/611/info Failure by the vixie cron daemon from validating the contents of a user supplied environment variable allow a malicious users to pass arbitrar...

Sendmail Redirection Relaying Allowed

The remote sendmail server accepts messages addressed to recipients of the form 'user@[email protected]'. A remote attacker could leverage this to reach mail servers behind a firewall or to avoid detection by routing mail through the affected host. C Tenable Network Security, Inc...

Sendmail mail from/rcpt to Pipe Arbitrary Command Execution

The remote SMTP server did not complain when issued the command : MAIL FROM: root@thishost RCPT TO: |testing This probably means that it is possible to send mail directly to programs, which is a serious threat, since this allows anyone to execute arbitrary commands on this host. This security hol...

Sendmail DEBUG/WIZ Remote Command Execution

Your MTA accepts the DEBUG or WIZ command. It may be an old version of Sendmail. This command is dangerous as it allows remote users to execute arbitrary commands as root without the need to log in. C Tenable Network Security, Inc. MA 2004-12-29: I merge sendmailwiz.nasl into this one...

Multiple MTA HELO Command Remote Overflow

The remote SMTP server seems to allow remote users to send mail anonymously by providing arguments that are too long to the HELO command more than 1024 chars. This problem may allow malicious users to send unsolicited mail i.e., SPAM or threatening mail using the server, and keep their anonymity....

sendmail-x.x.x-DoS.txt

Date: Sun, 6 Sep 1998 00:53:24 +0200 From: Michal Zalewski To: [email protected] Subject: Sendmail, lynx, Netscape, sshd, Linux kernel twice // greetings to kotka : // ...and everyone who could stand this post Hello boys and girls - probably everyone yearn after me : So I decided to publish so...

poc.mail.local.txt

Proof of Concept - Security Advisory 02/15/99 http://poc.csoft.net Released by [email protected] [email protected] --- Affected Program mail.local Berkeley Sendmail Description Local mailer forward mail to mailboxes Severity Mailbox compromise Synopsis: mail.local is a small program distributed wit...

sendmail-8.8.x-8.9.x.txt

Date: Sat, 12 Dec 1998 02:22:10 +0100 From: Michal Zalewski To: [email protected] Subject: Sendmail 8.8.x/8.9.x bugware Bottoms up! Two bugs and fixes - Sendmail 8.8.x/8.9.x. 1. Redirection attack Due to strange address parsing policy briefly: if address ends with local hostname, trim it and...

mail87.sh

/bin/sh Hi ! This is exploit for sendmail smtpd bug ver. 8.7-8.8.2 for FreeBSD, Linux and may be other platforms. This shell script does a root shell in /tmp directory. If you have any problems with it, drop me a letter. Have fun ! ----------------------...

sun.sendmail.security.txt

Date: Mon, 7 Jun 1999 13:56:23 -0700 From: Sun Security Coordination Team To: [email protected] Subject: Sun Security Bulletin 00187 -----BEGIN PGP SIGNED MESSAGE----- Sun Microsystems, Inc. Security Bulletin Bulletin Number: 00187 Date: June 7, 1999 Cross-Ref: Title: Version 8.8.8 Sendmail f...