# CVE-1999-0145: Sendmail WIZ command enabled allowing root access

Source: https://junglewise.ai/threats/cve-1999-0145-sendmail-wiz-command-enabled-allowing-root-access  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1993-09-30. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0145 · Severity: high · CVSS 7.2 · Published 1993-09-30

Sendmail is a widely used mail transfer agent for routing and delivering email. A legacy debugging command called 'WIZ' was left enabled in certain versions, which allows anyone with network access to the mail server to gain full administrative (root) control. This could lead to total system takeover, data theft, and the disruption of email services.

Technologies: [Eric Allman Sendmail](https://junglewise.ai/threats/technologies/sendmail). Vendors: [Eric Allman](https://junglewise.ai/threats/vendors/eric-allman).

## Quick answers

**Is CVE-1999-0145 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0145 being exploited in the wild.

**How severe is CVE-1999-0145?** High severity, with a CVSS score of 7.2, published 30 September 1993.

**Which products and versions are affected?** Sendmail Sendmail Versions prior to 1993 patches.

**Is there a fix for CVE-1999-0145?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0145 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-1999-0145?** Check whether you run Eric Allman Sendmail. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from the 'WIZ' (Wizard) command being enabled in the Sendmail SMTP daemon. This command was originally intended for debugging but lacks proper authentication or restriction in affected versions. By issuing the WIZ command followed by a specific password (often 'shell' or similar known strings in older versions), an attacker can spawn a root shell. This is a classic example of a 'backdoor' or 'debug' command left in production code. While the CVSS 2.0 vector provided by NVD suggests local access (AV:L), historical context and the nature of SMTP indicate this was frequently exploited over the network.

## Affected products

- Sendmail Sendmail Versions prior to 1993 patches

## Timeline

- 1993-09-30: advisory: NVD published date
- 1990-11-01: other: Related CERT advisory CA-1990-11 issued

## References

- [http://seclists.org/fulldisclosure/2019/Jun/16](http://seclists.org/fulldisclosure/2019/Jun/16)
- [http://www.alw.nih.gov/Security/Docs/admin-guide-to-cracking.101.html](http://www.alw.nih.gov/Security/Docs/admin-guide-to-cracking.101.html)
- [http://www.cert.org/advisories/CA-1990-11.html](http://www.cert.org/advisories/CA-1990-11.html)
- [http://www.cert.org/advisories/CA-1993-14.html](http://www.cert.org/advisories/CA-1993-14.html)
- [http://www.openwall.com/lists/oss-security/2019/06/05/4](http://www.openwall.com/lists/oss-security/2019/06/05/4)
- [http://www.openwall.com/lists/oss-security/2019/06/06/1](http://www.openwall.com/lists/oss-security/2019/06/06/1)
- [http://www2.dataguard.no/bugtraq/1995_1/0332.html](http://www2.dataguard.no/bugtraq/1995_1/0332.html)

## Related threats

- [Sendmail remote command execution via ident](https://junglewise.ai/threats/cve-1999-0204-sendmail-remote-command-execution-via-ident)
- [Sendmail command injection via pipe character](https://junglewise.ai/threats/cve-1999-0163-sendmail-command-injection-via-pipe-character)
- [Sendmail arbitrary command execution via SMTP bounce manipulation](https://junglewise.ai/threats/cve-1999-0203-sendmail-arbitrary-command-execution-via-smtp-bounce-manipulation)
- [Sendmail debug command enabled remote command execution](https://junglewise.ai/threats/cve-1999-0095-sendmail-debug-command-enabled-remote-command-execution)