Software Engineering Institute

There is a problem with the way that the older (circa 1995) versions of Sun Microsystems, Inc. version of sendmail processes the -oR option. This problem has been verified as existing in the version of sendmail that is in SunOS 4.1.X, including patches 100377-19 (for SunOS 4.1.3), 101665-04 (for SunOS 4.1.3_U1), and 102423-01 (for SunOS 4.1.4).

The -oR option specifies the host, called the mail hub, to which mail should be forwarded when a user on a client of that hub receives mail. This host can be identified with the -oR option on the command line as

-oRhost_name

or in the configuration file as:

ORhost_name

or by NFS mounting the /var/spool/mail directory from a file server, probably from the mail hub. In this case, the host name of the file server is used as the forwarding host identified as host_name above. All these configurations are vulnerable. For additional information, see CERT Advisory CA-95-11.

Specifically, the problem is that sendmail used popen to process these arguments. By correctly setting IFS and passing in appropriate values to the -oR option, local users could execute arbitrary commands with the privileges of the sendmail. An exploit exists for this problem.

Local users can obtain root access.

Upgrade to the most recent version of sendmail.