Quick answers
- Is CVE-1999-0095 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-1999-0095 being exploited in the wild.
- How severe is CVE-1999-0095?
- Critical severity, with a CVSS score of 10, published 1 October 1988.
- Which products and versions are affected?
- Sendmail Sendmail All versions prior to 1988 patch.
- Is there a fix for CVE-1999-0095?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-1999-0095 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-1999-0095?
- Check whether you run Eric Allman Sendmail. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Sendmail SMTP server was historically distributed with the 'DEBUG' command enabled in its production configuration. By connecting to the SMTP port (typically 25) and issuing the DEBUG command, an attacker can bypass standard security restrictions and execute arbitrary shell commands via the mail pipe. These commands are executed with root privileges because the Sendmail daemon typically runs as the superuser to manage mail delivery. This is a classic example of a 'backdoor' or insecure default configuration that allows full remote command execution (RCE) without authentication.
Affected products
- Sendmail Sendmail All versions prior to 1988 patch
Timeline
- 1988-10-01: disclosed: Vulnerability became widely known during the Morris Worm era.
- 1988-10-01: advisory