CVE-2003-0161

    Dashboard / Vulnerabilities / CVE-2003-0161

    CVE-2003-0161

    Published: 2 Apr 2003Last Modified: 10 Apr 2026

    Summary:

    Details: The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.

    References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:07.sendmail.asc, ftp://patches.sgi.com/support/free/security/advisories/20030401-01-P, http://www.cert.org/advisories/CA-2003-12.html, http://www.debian.org/security/2003/dsa-278, http://www.debian.org/security/2003/dsa-290, http://www.redhat.com/support/errata/RHSA-2003-120.html, http://www.securityfocus.com/bid/7230, http://www.cert.org/advisories/CA-2003-12.html, http://www.redhat.com/support/errata/RHSA-2003-120.html, http://www.securityfocus.com/bid/7230, ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-016.0.txt, ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2004.11/SCOSA-2004.11.txt, http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000614, http://lists.apple.com/mhonarc/security-announce/msg00028.html, http://lists.grok.org.uk/pipermail/full-disclosure/2003-March/004295.html, http://marc.info/?l=bugtraq&m=104896621106790&w=2, http://marc.info/?l=bugtraq&m=104897487512238&w=2, http://marc.info/?l=bugtraq&m=104914999806315&w=2, http://sunsolve.sun.com/search/document.do?assetkey=1-26-52620-1, http://sunsolve.sun.com/search/document.do?assetkey=1-26-52700-1, http://sunsolve.sun.com/search/document.do?assetkey=1-77-1001088.1-1, http://www.gentoo.org/security/en/glsa/glsa-200303-27.xml, http://www.kb.cert.org/vuls/id/897604, http://www.redhat.com/support/errata/RHSA-2003-121.html, http://www.securityfocus.com/archive/1/316961/30/25250/threaded, http://www.securityfocus.com/archive/1/317135/30/25220/threaded, http://www.securityfocus.com/archive/1/321997

    Affected packages

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High