CVE-2014-3956

The smcloseonexec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FDCLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program...

UBUNTU-CVE-2014-3956

The smcloseonexec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FDCLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program...

CVE-2014-3956

The smcloseonexec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FDCLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program...

Code injection

The smcloseonexec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FDCLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program...

CVE-2014-3956

The smcloseonexec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FDCLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program...

CVE-2014-3956

The smcloseonexec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FDCLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program...

CVE-2014-3956

CVE-2014-3956 affects sendmail up to version 8.14.9, where the sm_close_on_exec function in conf.c has its arguments in the wrong order, causing FD_CLOEXEC flags not to be set. This can allow local users to access unintended high-numbered file descriptors via a custom mail-delivery program. The c...

CVE-2014-3956

The smcloseonexec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FDCLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program...

FreeBSD Security Advisory FreeBSD-SA-14:11.sendmail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:11.sendmail Security Advisory The FreeBSD Project Topic: sendmail improper close-on-exec flag handling Category: contrib Module: sendmail Announced: 2014-06-...

CVE-2014-3956: Exposure of Sensitive Information to an Unauthorized Actor

The smcloseonexec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FDCLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program...

Sendmail < 8.14.9 close-on-exec SMTP Connection Manipulation

The remote mail server is running a version of Sendmail prior to 8.14.9. It is, therefore, affected by a flaw related to file descriptors and the 'close-on-exec' flag that may allow a local attacker to cause unspecified impact on open SMTP connections. C Tenable Network Security, Inc...

FreeBSD-SA-14:11.sendmail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:11.sendmail Security Advisory The FreeBSD Project Topic: sendmail improper close-on-exec flag handling Category: contrib Module: sendmail Announced:...

FreeBSD -- sendmail improper close-on-exec flag handling

Problem Description: There is a programming error in sendmail8 that prevented open file descriptors have close-on-exec properly set. Consequently a subprocess will be able to access all open files that the parent process have open. Impact: A local user who can execute their own program for mail...

PT-2014-1706

Name of the Vulnerable Software and Affected Versions sendmail versions prior to 8.14.9 Description The issue exists in the sm close on exec function due to incorrect argument order and missing expected FD CLOEXEC flags. This allows local users to access high-numbered file descriptors using a...

Destoon B2B 2014-05-21最新版csrf getshell

简要描述： 上传问题+csrf+后台任意命令执行 = csrf getshell 详细说明： 先说上传问题，自带的fck编辑器没有验证上传图片的合法性，只判断了后缀名。 可以通过上传一个.jpg后缀的swf来进行csrf 然后是后台命令执行 /member/admin/sendmail.inc.php 行151 default: ifisset$send ifisset$preview && $preview $content = stripslashes$content; if$template if$sendtype == 2 $emails = explode"\n",...

PT-2014-2707

Name of the Vulnerable Software and Affected Versions Kasseler CMS versions prior to 2 r1232 Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks. This can be achieved via the groups parameter in a send action...

CVE-2013-3729: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 groups parameter in a send action in the sendmail module or 2 query parameter in ...

IT-Grundschutz M5.019: Einsatz der Sicherheitsmechanismen von sendmail

IT-Grundschutz M5.019: Einsatz der Sicherheitsmechanismen von sendmail. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.95056 Stand: 13. Ergänzungslieferung 13. EL...

IT-Grundschutz M5.019: Einsatz der Sicherheitsmechanismen von sendmail

IT-Grundschutz M5.019: Einsatz der Sicherheitsmechanismen von sendmail. ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.95056 Stand: 13. Ergänzungslieferung 13. EL...

AIX 7.1 : bos.net.tcp.client (U858320)

The remote host is missing AIX PTF U858320, which is related to the security of the package bos.net.tcp.client. AIX system set up with stock sendmail will run arbitrary code through a users .forward. This apples to sendmailssl and sendmailnossl. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...