Unscored severity · published Apr 2, 2003
CVE-2003-0161
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length…
–
CVSS
38.8%
EPSS
No
On KEV
Description
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
Exploitation
Is it being used?
Exploit prediction (EPSS)38.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HP
Hp-ux · HP
10.00; 10.01; 10.08; 10.09; 10.10; 10.16; +10 more · source: NVD
HS
Hp-ux Series 700 · HP
10.20 · source: NVD
HS
Hp-ux Series 800 · HP
10.20 · source: NVD
SE
Sendmail · Sendmail
2.6; 2.6.1; 2.6.2; 3.0; 3.0.1; 3.0.2; +29 more · source: NVD
SS
Sendmail Switch · Sendmail
2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +10 more · source: NVD
SI
Sis · HP
All versions, or not specified · source: NVD
SO
Solaris · Sun
2.4; 2.5; 2.5.1; 2.5.1; 2.6; 7.0; +4 more · source: NVD
SU
Sunos · Sun
5.4; 5.5; 5.5.1; 5.7; 5.8 · source: NVD
TR
Tru64 · Compaq
4.0b; 4.0d; 4.0d_pk9_bl17; 4.0f; 4.0f_pk6_bl17; 4.0f_pk7_bl18; +19 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-0161
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-0161
distro.conectiva.com.br
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000614
lists.apple.com
http://lists.apple.com/mhonarc/security-announce/msg00028.html
More from Tru64
–
CVE-2005-0223
The Software Development Kit (SDK) and Run Time Environment (RTE) 1.4.1 and 1.4.2 for Tru64 UNIX allows remote attackers to cause a denial of service (Java Virtual Machine hang)…
–
CVE-2003-0914
ISC BIND 8.3.x before 8.3.7, and 8.4.x before 8.4.3, allows remote attackers to poison the cache via a malicious name server that returns negative responses with a large TTL…
–
CVE-2003-0724
ssh on HP Tru64 UNIX 5.1B and 5.1A does not properly handle RSA signatures when digital certificates and RSA keys are used, which could allow local and remote attackers to gain…
–
CVE-2003-0688
The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a…
–
CVE-2003-0694
The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c