Security researchers have unearthed a flaw in Sendmail, the popular email server package that's widely used by ISPs. A security bug involving improper handling of asynchronous signal data by Sendmail when receiving and processing mail might be used to corrupt stack memory. By sending specially malformed data at controlled time intervals hackers might be able to take advantage of the flaw to compromise vulnerable systems.

Sendmail packages up to and including versions 8.13.5 as well as Sendmail 8.12.11 and earlier versions are vulnerable to exploitation. Users of the commercial versions of Sendmail are also potentially at risk and may need to apply patches (as explained here and here).

No exploit currently exists. Nonetheless the Sendmail Consortium urges users to either upgrade to Sendmail 8.13.6 or to apply patches to 8.13.5 and 8.12.11 versions of its software. Customers running commercial versions of Sendmail need to apply vendor-supplied patches. Credit for discovering the vulnerability goes to security researcher Mark Dowd of security tools firm ISS (advisory here). ®

Related stories

• Email pioneer says breakthrough was too much trouble (1 December 2006)
• Comment Sendmail and secure design (7 May 2006)
• Cisco's 'Black Hat' nemesis joins Juniper (8 November 2005)
• Analysis OS exploits are 'old hat' (8 August 2005)
• Oi! *Nix admin, get patching (18 September 2003)
• Sendmail vuln. Patch now (4 March 2003)