Executive brief
A vulnerability in the qmail email server allows a remote attacker to crash the system or make it unresponsive. By sending an excessive number of recipient addresses in a single email transaction, an attacker can exhaust the server's memory and swap space. This results in a total denial of service, preventing the organization from sending or receiving legitimate email and potentially impacting other services on the same host.
Technical details
The qmail-smtpd component fails to impose a configurable upper bound on the number of RCPT commands accepted per message. A remote, unauthenticated attacker can establish an SMTP connection and transmit an infinite stream of 'RCPT TO' commands. Because qmail-smtpd dynamically allocates memory to track these recipients, the process will eventually consume all available physical memory and swap space on the host. This leads to a denial of service (DoS) through resource exhaustion. While the vendor argued that system-level resource limits (rlimits) should be used to mitigate such issues, the lack of application-level enforcement allows for trivial exploitation on default configurations.
Affected products
- qmail qmail 1.0 and earlier
Timeline
- 1997-06-11: disclosed: Vulnerability details and proof-of-concept code shared on the qmail mailing list.
- 1997-07-01: advisory: NVD published the CVE record.