AOH :: HP Unsorted S :: B06-3178.HTM

Sendmail mime dos vulnerability



Sendmail MIME DoS vulnerability
Sendmail MIME DoS vulnerability



Hi,

I am trying to understand how the below mentioned sendmail
vulnerability. 
http://www.sendmail.com/security/advisories/SA-200605-01.txt.asc 

The description says that the DoS occurs when sendmail goes in a deeply
nested malformed MIME message and uses the MIME 8-bit to 7-bit
conversion function. Under what conditions would sendmail use the MIME
8-bit to 7-bit function? Only when the remote MTA doesn't understand
8-bit MIME, right?

That would mean that a malicious user would have to force the victim MTA
to relay the malformed mail to a MIME 7-bit-only MTA for the attack to
succeed. This probably means that open relays and ISP SMTP servers are
more vulnerable than purely incoming SMTP servers.

I am just trying to make sense of the advisory and the possible threat
of exploit.


Thanks,

- Siddhartha

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.