Executive brief
A vulnerability in older versions of Sendmail, a widely used email routing system, allows an attacker to execute commands with administrative privileges. By using a specific character in email addresses or configuration strings, a local user can bypass security controls to take full control of the server. This could lead to the theft of sensitive data, complete system shutdown, or the use of the server for further malicious activities.
Technical details
This vulnerability is a command injection flaw in Sendmail's handling of the pipe ('|') character. A local attacker can provide input containing a pipe character to the Sendmail binary, which fails to properly sanitize the input before passing it to a shell. Because Sendmail often runs with elevated privileges (setuid root) to handle mail delivery, this allows the attacker to execute arbitrary commands as the root user. The vulnerability is exploited locally and does not require prior authentication beyond access to the system's mail utilities. Modern versions of Sendmail have long since patched this behavior by improving input validation and dropping privileges where possible.
Affected products
- Sendmail Sendmail Older versions (pre-1997)
Timeline
- 1997-01-01: disclosed: Initial NVD publication date