{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eToutes les versions de sendmail 8.12.x.  \u003cP\u003eLa version 8.12.9 de sendmail corrige cette vuln\u00e9rabilit\u00e9.\u003c/P\u003e\u003c/p\u003e",
  "content": "## Description\n\nSendmail, logiciel de routage de messages \u00e9lectroniques, peut collecter\ndes informations sur des machines (fonctionnalit\u00e9 DNS MAPS) au moyen de\nrequ\u00eates DNS.\n\nUne vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire pr\u00e9sente dans le\ntraitement de ces requ\u00eates DNS permet \u00e0 un utilisateur mal intentionn\u00e9\ncontr\u00f4lant un serveur DNS hostile de r\u00e9aliser un d\u00e9ni de service par\narr\u00eat du serveur de messagerie sendmail.\n\nIl est \u00e0 noter que cette vuln\u00e9rabilit\u00e9 n\u0027est exploitable que si la\nprimitive FEATURE(\u0027enhdnsbl\u0027) est pr\u00e9sente dans le fichier de\nconfiguration de sendmail.\n\n## Solution\n\nInstaller sendmail 8.12.9 disponible sur le site sendmail.org :\n\n    http://www.sendmail.org/dnsmap1.html\n\nou appliquer le correctif de l\u0027\u00e9diteur :\n\n-   Bulletin de s\u00e9curit\u00e9 MDKSA-2003:086 de Mandrake :\n\n        http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:086\n\n-   Bulletin de s\u00e9curit\u00e9 SuSE-SA:2003:035 de SuSE :\n\n        http://www.suse.com/de/security/2003_035_sendmail.html\n\n-   Bulletin de s\u00e9curit\u00e9 20030803-01-P de SGI :\n\n        ftp://patches.sgi.com/support/free/security/advisories/20030803-01-P\n\n-   Bulletin de s\u00e9curit\u00e9 FreeBSD-SA-03:11 de FreeBSD :\n\n        ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:11.sendmail.asc\n\n-   Bulletin de s\u00e9curit\u00e9 RHSA-2003:265 de Red Hat :\n\n        http://rhn.redhat.com/errata/RHSA-2003-265.html\n\n-   Bulletin de s\u00e9curit\u00e9 d\u0027OpenBSD :\n\n        http://www.openbsd.org/errata32.html#sendmail3\n",
  "cves": [],
  "links": [
    {
      "title": "Annonce \"DNS map problem in 8.12.x before 8.12.9\" :",
      "url": "http://www.sendmail.org/dnsmap1.html"
    },
    {
      "title": "Note VU#993452 du cert/cc :",
      "url": "http://www.kb.cert.org/vuls/id/993452"
    }
  ],
  "reference": "CERTA-2003-AVI-141",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2003-08-27T00:00:00.000000"
    },
    {
      "description": "ajout r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 de Red Hat.",
      "revision_date": "2003-08-29T00:00:00.000000"
    },
    {
      "description": "ajout r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 d\u0027OpenBSD.",
      "revision_date": "2003-09-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 pr\u00e9sente dans le traitement de certaines requ\u00eates DNS\npermet \u00e0 un utilisateur mal intentionn\u00e9 de r\u00e9aliser un d\u00e9ni de service\npar arr\u00eat du serveur de messagerie sendmail.\n",
  "title": "Vuln\u00e9rabilit\u00e9 de sendmail",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Avis MDKSA-2003:086 de Mandrake",
      "url": null
    },
    {
      "published_at": null,
      "title": "Avis 20030803-01-P de SGI",
      "url": null
    },
    {
      "published_at": null,
      "title": "Avis FreeBSD-SA-03:11 de FreeBSD",
      "url": null
    },
    {
      "published_at": null,
      "title": "Avis de s\u00e9curit\u00e9 SuSE-SA:2003:035 de SuSE",
      "url": null
    }
  ]
}