Executive brief
A critical vulnerability exists in Sendmail, a widely used mail transfer agent, where a debugging feature was left enabled by default. This allows an unauthorized person to remotely issue commands that the server will execute with the highest possible system privileges (root). An attacker could use this to take full control of the server, access sensitive emails, or disrupt mail services.
Technical details
The Sendmail SMTP server was historically distributed with the 'DEBUG' command enabled in its production configuration. By connecting to the SMTP port (typically 25) and issuing the DEBUG command, an attacker can bypass standard security restrictions and execute arbitrary shell commands via the mail pipe. These commands are executed with root privileges because the Sendmail daemon typically runs as the superuser to manage mail delivery. This is a classic example of a 'backdoor' or insecure default configuration that allows full remote command execution (RCE) without authentication.
Affected products
- Sendmail Sendmail All versions prior to 1988 patch
Timeline
- 1988-10-01: disclosed: Vulnerability became widely known during the Morris Worm era.
- 1988-10-01: advisory