CVE:CVE-2003-0694
CNNVD:CNNVD-200310-019
Sendmail是一款互联网上最流行的邮件传输代理(MTA)。
Sendmail中的prescan()函数(与 http://www.nsfocus.net/index.php?act=sec_bug&do=view&bug_id=4625 描述的漏洞不同)存在问题，远程攻击者可以利用这个漏洞可能以Sendmail进程权限在系统上执行任意指令。
在Linux上的本地利用方法可以通过recipient.c和sendtolist()，利用用户提交的数据覆盖指针，在调用free()函数时可能导致指令重定向，攻击者可以构建恶意邮件消息提交给Sendmail解析可能以Sendmail进程权限在系统上执行任意指令。一般的利用方式是通过parseaddr()函数间接调用prescan()函数来覆盖一些数据结构来触发溢出，也有可能存在其他的利用方式，远程利用此漏洞也是可能的。
solution:Upgrade sendmail advanced_message_server to a higher version than 1.2,1.3,and avoid the version 1.2,1.3; Upgrade sendmail sendmail to a higher version than 2.6,2.6.1,2.6.2,3.0,3.0.1,3.0.2,3.0.3,8.8.8,8.9.0,8.9.1,8.9.2,8.9.3,8.10,8.10.1,8.10.2,8.11.0,8.11.1,8.11.2,8.11.3,8.11.4,8.11.5,8.11.6,8.12:beta10,8.12:beta12,8.12:beta16,8.12:beta5,8.12:beta7,8.12.0,8.12.1,8.12.2,8.12.3,8.12.4,8.12.5,8.12.6,8.12.7,8.12.8,8.12.9,and avoid the version 2.6,2.6.1,2.6.2,3.0,3.0.1,3.0.2,3.0.3,8.8.8,8.9.0,8.9.1,8.9.2,8.9.3,8.10,8.10.1,8.10.2,8.11.0,8.11.1,8.11.2,8.11.3,8.11.4,8.11.5,8.11.6,8.12:beta10,8.12:beta12,8.12:beta16,8.12:beta5,8.12:beta7,8.12.0,8.12.1,8.12.2,8.12.3,8.12.4,8.12.5,8.12.6,8.12.7,8.12.8,8.12.9; Upgrade sendmail sendmail_pro to a higher version than 8.9.2,8.9.3,and avoid the version 8.9.2,8.9.3; Upgrade sendmail sendmail_switch to a higher version than 2.1,2.1.1,2.1.2,2.1.3,2.1.4,2.1.5,2.2,2.2.1,2.2.2,2.2.3,2.2.4,2.2.5,3.0,3.0.1,3.0.2,3.0.3,and avoid the version 2.1,2.1.1,2.1.2,2.1.3,2.1.4,2.1.5,2.2,2.2.1,2.2.2,2.2.3,2.2.4,2.2.5,3.0,3.0.1,3.0.2,3.0.3; Upgrade sgi irix to a higher version than 6.5.15,6.5.16,6.5.17f,6.5.17m,6.5.18f,6.5.18m,6.5.19f,6.5.19m,6.5.20f,6.5.20m,6.5.21f,6.5.21m,and avoid the version 6.5.15,6.5.16,6.5.17f,6.5.17m,6.5.18f,6.5.18m,6.5.19f,6.5.19m,6.5.20f,6.5.20m,6.5.21f,6.5.21m; Upgrade apple mac_os_x to a higher version than 10.2,10.2.1,10.2.2,10.2.3,10.2.4,10.2.5,10.2.6,and avoid the version 10.2,10.2.1,10.2.2,10.2.3,10.2.4,10.2.5,10.2.6; Upgrade apple mac_os_x_server to a higher version than 10.2,10.2.1,10.2.2,10.2.3,10.2.4,10.2.5,10.2.6,and avoid the version 10.2,10.2.1,10.2.2,10.2.3,10.2.4,10.2.5,10.2.6; Upgrade compaq tru64 to a higher version than 4.0f,4.0f_pk6_bl17,4.0f_pk7_bl18,4.0f_pk8_bl22,4.0g,4.0g_pk3_bl17,4.0g_pk4_bl22,5.1,5.1_pk3_bl17,5.1_pk4_bl18,5.1_pk5_bl19,5.1_pk6_bl20,5.1a,5.1a_pk1_bl1,5.1a_pk2_bl2,5.1a_pk3_bl3,5.1a_pk4_bl21,5.1a_pk5_bl23,5.1b,5.1b_pk1_bl1,5.1b_pk2_bl22,and avoid the version 4.0f,4.0f_pk6_bl17,4.0f_pk7_bl18,4.0f_pk8_bl22,4.0g,4.0g_pk3_bl17,4.0g_pk4_bl22,5.1,5.1_pk3_bl17,5.1_pk4_bl18,5.1_pk5_bl19,5.1_pk6_bl20,5.1a,5.1a_pk1_bl1,5.1a_pk2_bl2,5.1a_pk3_bl3,5.1a_pk4_bl21,5.1a_pk5_bl23,5.1b,5.1b_pk1_bl1,5.1b_pk2_bl22; Upgrade freebsd freebsd to a higher version than 3.0:releng,4.0:releng,4.3:release_p38,4.3:releng,4.4:release_p42,4.4:releng,4.5:release_p32,4.5:releng,4.6:release_p20,4.6:releng,4.7:release_p17,4.7:releng,4.8:release_p6,4.8:releng,4.9:pre-release,5.0:release_p14,5.0:releng,5.1:release_p5,5.1:releng,and avoid the version 3.0:releng,4.0:releng,4.3:release_p38,4.3:releng,4.4:release_p42,4.4:releng,4.5:release_p32,4.5:releng,4.6:release_p20,4.6:releng,4.7:release_p17,4.7:releng,4.8:release_p6,4.8:releng,4.9:pre-release,5.0:release_p14,5.0:releng,5.1:release_p5,5.1:releng; Upgrade gentoo linux to a higher version than 0.5,0.7,1.1a,1.2,1.4:rc1,1.4:rc2,1.4:rc3,and avoid the version 0.5,0.7,1.1a,1.2,1.4:rc1,1.4:rc2,1.4:rc3; Upgrade hp hp-ux to a higher version than 11.00,11.0.4,11.11,11.22,and avoid the version 11.00,11.0.4,11.11,11.22; Upgrade ibm aix to a higher version than 4.3.3,5.1,5.2,and avoid the version 4.3.3,5.1,5.2; Upgrade netbsd netbsd to a higher version than 1.4.3,1.5,1.5.1,1.5.2,1.5.3,1.6,1.6:beta,1.6.1,and avoid the version 1.4.3,1.5,1.5.1,1.5.2,1.5.3,1.6,1.6:beta,1.6.1; Upgrade sun solaris to a higher version than 2.6,7.0,8.0,9.0,and avoid the version 2.6,7.0,8.0,9.0; Upgrade sun sunos to a higher version than -,5.7,5.8,and avoid the version 5.7,5.8; Upgrade turbolinux turbolinux_advanced_server to a higher version than 6.0,and avoid the version 6.0; Upgrade turbolinux turbolinux_server to a higher version than 6.1,6.5,7.0,8.0,and avoid the version 6.1,6.5,7.0,8.0; Upgrade turbolinux turbolinux_workstation to a higher version than 6.0,7.0,8.0,and avoid the version 6.0,7.0,8.0