CVE-2006-1173

Published: Jun 7, 2006Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Sendmail before 8.13.7 allows remote attackers to cause a denial of service via deeply nested, malformed multipart MIME messages that exhaust the stack during the recursive mime8to7 function for performing 8-bit to 7-bit conversion, which prevents Sendmail from delivering queued messages and might lead to disk consumption by core dump files.

Affected (41)

Products: Sendmail: Sendmail

Sendmail

1 product

Sendmail

Configuration A

41 vulnerable

Vulnerable Software	Affected Versions
Sendmail Sendmail	Up to 8.13.6
Sendmail Sendmail	Version 8.10.1
Sendmail Sendmail	Version 8.10.2
Sendmail Sendmail	Version 8.10
Sendmail Sendmail	Version 8.11.0
Sendmail Sendmail	Version 8.11.1
Sendmail Sendmail	Version 8.11.2
Sendmail Sendmail	Version 8.11.3
Sendmail Sendmail	Version 8.11.4
Sendmail Sendmail	Version 8.11.5
Sendmail Sendmail	Version 8.11.6
Sendmail Sendmail	Version 8.11.7
Sendmail Sendmail	Version 8.12.0
Sendmail Sendmail	Version 8.12.10
Sendmail Sendmail	Version 8.12.11
Sendmail Sendmail	Version 8.12.1
Sendmail Sendmail	Version 8.12.2
Sendmail Sendmail	Version 8.12.3
Sendmail Sendmail	Version 8.12.4
Sendmail Sendmail	Version 8.12.5
Sendmail Sendmail	Version 8.12.6
Sendmail Sendmail	Version 8.12.7
Sendmail Sendmail	Version 8.12.8
Sendmail Sendmail	Version 8.12.9
Sendmail Sendmail	Version 8.12 beta10
Sendmail Sendmail	Version 8.12 beta12
Sendmail Sendmail	Version 8.12 beta16
Sendmail Sendmail	Version 8.12 beta5
Sendmail Sendmail	Version 8.12 beta7
Sendmail Sendmail	Version 8.13.0
Sendmail Sendmail	Version 8.13.1.2
Sendmail Sendmail	Version 8.13.1
Sendmail Sendmail	Version 8.13.2
Sendmail Sendmail	Version 8.13.3
Sendmail Sendmail	Version 8.13.4
Sendmail Sendmail	Version 8.13.5
Sendmail Sendmail	Version 8.8.8
Sendmail Sendmail	Version 8.9.0
Sendmail Sendmail	Version 8.9.1
Sendmail Sendmail	Version 8.9.2
Sendmail Sendmail	Version 8.9.3

Related CWEs

CWE-399

References (112)

ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:17.sendmail.asc (unsafe URL)

Source: cret@cert.org

ftp://patches.sgi.com/support/free/security/advisories/20060601-01-P (unsafe URL)

Source: cret@cert.org

ftp://patches.sgi.com/support/free/security/advisories/20060602-01-U.asc (unsafe URL)

Source: cret@cert.org

http://itrc.hp.com/service/cki/docDisplay.do?docId=c00692635

Source: cret@cert.org

http://lists.suse.com/archive/suse-security-announce/2006-Jun/0006.html

Source: cret@cert.org

http://secunia.com/advisories/15779

Source: cret@cert.org

PatchVendor Advisory

http://secunia.com/advisories/20473

Source: cret@cert.org

PatchVendor Advisory

http://secunia.com/advisories/20641

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/20650

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/20651

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/20654

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/20673

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/20675

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/20679

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/20683

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/20684

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/20694

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/20726

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/20782

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/21042

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/21160

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/21327

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/21612

Source: cret@cert.org

Vendor Advisory

http://secunia.com/advisories/21647

Source: cret@cert.org

Vendor Advisory

http://securitytracker.com/id?1016295

Source: cret@cert.org

http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.631382

Source: cret@cert.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102460-1

Source: cret@cert.org

PatchVendor Advisory

http://support.avaya.com/elmodocs2/security/ASA-2006-148.htm

Source: cret@cert.org

http://www-1.ibm.com/support/search.wss?rs=0&q=IY85415&apar=only

Source: cret@cert.org

http://www-1.ibm.com/support/search.wss?rs=0&q=IY85930&apar=only

Source: cret@cert.org

http://www.debian.org/security/2006/dsa-1155

Source: cret@cert.org

http://www.f-secure.com/security/fsc-2006-5.shtml

Source: cret@cert.org

http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-18.html

Source: cret@cert.org

http://www.gentoo.org/security/en/glsa/glsa-200606-19.xml

Source: cret@cert.org

http://www.kb.cert.org/vuls/id/146718

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

http://www.mandriva.com/security/advisories?name=MDKSA-2006:104

Source: cret@cert.org

http://www.openbsd.org/errata38.html#sendmail2

Source: cret@cert.org

http://www.osvdb.org/26197

Source: cret@cert.org

http://www.redhat.com/support/errata/RHSA-2006-0515.html

Source: cret@cert.org

http://www.securityfocus.com/archive/1/437928/100/0/threaded

Source: cret@cert.org

http://www.securityfocus.com/archive/1/438241/100/0/threaded

Source: cret@cert.org

http://www.securityfocus.com/archive/1/438330/100/0/threaded

Source: cret@cert.org

http://www.securityfocus.com/archive/1/440744/100/0/threaded

Source: cret@cert.org

http://www.securityfocus.com/archive/1/442939/100/0/threaded

Source: cret@cert.org

http://www.securityfocus.com/bid/18433

Source: cret@cert.org

Patch

http://www.sendmail.com/security/advisories/SA-200605-01.txt.asc

Source: cret@cert.org

PatchVendor Advisory

http://www.vupen.com/english/advisories/2006/2189

Source: cret@cert.org

http://www.vupen.com/english/advisories/2006/2351

Source: cret@cert.org

http://www.vupen.com/english/advisories/2006/2388

Source: cret@cert.org

http://www.vupen.com/english/advisories/2006/2389

Source: cret@cert.org

Vendor Advisory

http://www.vupen.com/english/advisories/2006/2390

Source: cret@cert.org

http://www.vupen.com/english/advisories/2006/2798

Source: cret@cert.org

http://www.vupen.com/english/advisories/2006/3135

Source: cret@cert.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/27128

Source: cret@cert.org

https://issues.rpath.com/browse/RPL-526

Source: cret@cert.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11253

Source: cret@cert.org

ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:17.sendmail.asc (unsafe URL)