Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files.

The remote host is missing AIX PTF U497412, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U477911, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U807468, which is related to the security of the package bos.net.tcp.client.

The remote host is missing AIX PTF U806039, which is related to the security of the package bos.net.tcp.client.

It turned out that the sendmail binary depends on libsasl2 (>= 2.1.19.dfsg1) which is neither available in the stable nor in the security archive. This version is scheduled for the inclusion in the next update of the stable release, though.

You'll have to download the referenced file for your architecture from below and install it with dpkg -i.

As an alternative, temporarily adding the following line to /etc/apt/sources.list will mitigate the problem as well :

  deb http://ftp.debian.de/debian stable-proposed-updates main

Here is the original security advisory for completeness :

  Frank Sheiness discovered that a MIME conversion routine in   sendmail, a powerful, efficient, and scalable mail transport agent,   could be tricked by a specially crafted mail to perform an endless   recursion.

s700_800 11.11 sendmail(1M) 8.9.3 patch : 

A potential security vulnerability has been identified with HP-UX running Sendmail processing malformed multipart MIME messages. This vulnerability could potentially allow a remote unauthenticated user to cause a Denial of Service (DoS).

s700_800 11.04 (VVOS) sendmail(1m) 8.9.3 patch : 

The remote HP-UX host is affected by multiple vulnerabilities :

  - A vulnerability has been identified in sendmail which     may allow a remote attacker to execute arbitrary code.
    References: CVE-2006-0058, US-CERT VU#834865.
    (HPSBUX02108 SSRT061133)

  - A potential security vulnerability has been identified     with HP-UX running Sendmail processing malformed     multipart MIME messages. This vulnerability could     potentially allow a remote unauthenticated user to cause     a Denial of Service (DoS). (HPSBUX02124 SSRT061159)

s700_800 11.00 sendmail(1m) 8.9.3 patch : 

A potential security vulnerability has been identified with HP-UX running Sendmail processing malformed multipart MIME messages. This vulnerability could potentially allow a remote unauthenticated user to cause a Denial of Service (DoS).

s700_800 11.23 sendmail(1m) 8.11.1 patch : 

A potential security vulnerability has been identified with HP-UX running Sendmail processing malformed multipart MIME messages. This vulnerability could potentially allow a remote unauthenticated user to cause a Denial of Service (DoS).

Updated sendmail packages are now available to fix a denial of service security issue.

This update has been rated as having important security impact by the Red Hat Security Response Team.

[Updated 27 June 2006] The sendmail-docs packages for Red Hat Enterprise Linux 3 have been updated to the correct version and release.

Sendmail is a Mail Transport Agent (MTA) used to send mail between machines.

A flaw in the handling of multi-part MIME messages was discovered in Sendmail. A remote attacker could create a carefully crafted message that could crash the sendmail process during delivery (CVE-2006-1173).
By default on Red Hat Enterprise Linux, Sendmail is configured to only accept connections from the local host. Therefore, only users who have configured Sendmail to listen to remote hosts would be remotely vulnerable to this issue.

Users of Sendmail are advised to upgrade to these erratum packages, which contain a backported patch from the Sendmail team to correct this issue.

A vulnerability in the way Sendmail handles multi-part MIME messages was discovered that could allow a remote attacker to create a carefully crafted message that could crash the sendmail process during delivery.

The updated packages have been patched to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200606-19 (Sendmail: Denial of Service)

    Frank Sheiness discovered that the mime8to7() function can recurse     endlessly during the decoding of multipart MIME messages until the     stack of the process is filled and the process crashes.
  Impact :

    By sending specially crafted multipart MIME messages, a remote     attacker can cause a subprocess forked by Sendmail to crash. If     Sendmail is not set to use a randomized queue processing, the attack     will effectively halt the delivery of queued mails as well as the     malformed one, incoming mail delivered interactively is not affected.
    Additionally, on systems where core dumps with an individual naming     scheme (like 'core.pid') are enabled, a filesystem may fill up with     core dumps. Core dumps are disabled by default in Gentoo.
  Workaround :

    The Sendmail 8.13.7 release information offers some workarounds, please     see the Reference below. Note that the issue has actually been fixed in     the 8.13.6-r1 ebuild.

New sendmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix a possible denial-of-service issue. Sendmail's complete advisory may be found here:
http://www.sendmail.com/security/advisories/SA-200605-01.txt.asc Sendmail has also provided an FAQ about this issue:
http://www.sendmail.com/security/advisories/SA-200605-01/faq.shtml The CVE entry for this issue may be found here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1173

According to its banner, the remote sendmail server is running a version less than 8.13.7.  There is a flaw in versions of Sendmail less than 8.13.7 that would allow a remote attacker to deny resources to legitimate users.  An attacker exploiting this flaw would only need to be able to send email through the remote sendmail server.

SunOS 5.9_x86: sendmail Patch.
Date this patch was last updated by Sun : Mar/04/08

SunOS 5.9: sendmail patch.
Date this patch was last updated by Sun : Feb/05/08

ID	Name	Product	Family	Severity
65264	AIX 5.3 TL 5 / 5.3 TL 4 : bos.net.tcp.client (U497412)	Nessus	AIX Local Security Checks	medium
65261	AIX 5.2 TL 9 / 5.2 TL 8 : bos.net.tcp.client (U477911)	Nessus	AIX Local Security Checks	medium
28637	AIX 5.3 TL 4 / 5.3 TL 5 : bos.net.tcp.client (U807468)	Nessus	AIX Local Security Checks	medium
28597	AIX 5.2 TL 8 : bos.net.tcp.client (U806039)	Nessus	AIX Local Security Checks	medium
22697	Debian DSA-1155-2 : sendmail - programming error	Nessus	Debian Local Security Checks	medium
22176	HP-UX PHNE_34936 : HP-UX Sendmail MIME Remote Denial of Service (DoS) (HPSBUX02124 SSRT061159 rev.2)	Nessus	HP-UX Local Security Checks	medium
22175	HP-UX PHNE_34927 : s700_800 11.04 (VVOS) sendmail(1m) 8.9.3 patch	Nessus	HP-UX Local Security Checks	high
22174	HP-UX PHNE_34900 : HP-UX Sendmail MIME Remote Denial of Service (DoS) (HPSBUX02124 SSRT061159 rev.2)	Nessus	HP-UX Local Security Checks	medium
22173	HP-UX PHNE_34689 : HP-UX Sendmail MIME Remote Denial of Service (DoS) (HPSBUX02124 SSRT061159 rev.2)	Nessus	HP-UX Local Security Checks	medium
21903	CentOS 3 / 4 : sendmail (CESA-2006:0515)	Nessus	CentOS Local Security Checks	medium
21721	RHEL 2.1 / 3 / 4 : sendmail (RHSA-2006:0515)	Nessus	Red Hat Local Security Checks	medium
21719	Mandrake Linux Security Advisory : sendmail (MDKSA-2006:104)	Nessus	Mandriva Local Security Checks	medium
21712	GLSA-200606-19 : Sendmail: Denial of Service	Nessus	Gentoo Local Security Checks	medium
21699	Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : sendmail (SSA:2006-166-01)	Nessus	Slackware Local Security Checks	medium
3653	Sendmail < 8.13.7 Multi-part MIME Message Handling DoS	Nessus Network Monitor	SMTP Servers	medium
13592	Solaris 9 (x86) : 114137-10	Nessus	Solaris Local Security Checks	high
13541	Solaris 9 (sparc) : 113575-11	Nessus	Solaris Local Security Checks	high

Detections

Analytics

CVE-2006-1173

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

high

high