Summary
The remote host is missing an update to sendmail
announced via advisory DSA 257-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20257-1
Insight
Mark Dowd of ISS X-Force found a bug in the header parsing routines of sendmail: it could overflow a buffer overflow when encountering addresses with very long comments. Since sendmail also parses headers when forwarding emails this vulnerability can hit mail-servers which do not deliver the email as well.
This has been fixed in upstream release 8.12.8, version 8.12.3-5 of the package for Debian GNU/Linux 3.0/woody and version 8.9.3-25 of the package for Debian GNU/Linux 2.2/potato.
Severity
Classification
-
CVE CVE-2002-1337 -
CVSS Base Score: 10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Related Vulnerabilities