Sendmail MIME DoS vulnerability Jun 20 2006 10:57PM
Jain, Siddhartha (Siddhartha Jain kla-tencor com) (2 replies)
Re: Sendmail MIME DoS vulnerability Jun 24 2006 05:51AM
Claus Assmann ca+bugtraq (at) zardoc.endmail (dot) org [email concealed] (ca+bugtraq zardoc endmail org)
On Tue, Jun 20, 2006, Jain, Siddhartha wrote:

> The description says that the DoS occurs when sendmail goes in a deeply
> nested malformed MIME message and uses the MIME 8-bit to 7-bit
> conversion function. Under what conditions would sendmail use the MIME
> 8-bit to 7-bit function? Only when the remote MTA doesn't understand
> 8-bit MIME, right?


A malformed MIME structure with many parts can cause sendmail to
crash while trying to send a mail due to a stack overflow,
e.g., if the stack size is limited (ulimit -s). This
happens because the recursion of the function mime8to7()
was not restricted. The function is called for MIME 8 to
7 bit conversion and also to enforce MaxMimeHeaderLength.
To work around this problem, recursive calls are limited to
a depth of MAXMIMENESTING (20); message content after this
limit is treated as opaque and is not checked further.

For details see sendmail/deliver.c, just search for mime8to7().

[ reply ]
Re: Sendmail MIME DoS vulnerability Jun 21 2006 06:32PM
Gadi Evron (ge linuxbox org)


Privacy Statement
Copyright 2010, SecurityFocus