NetSight
IP …
medium4.6Public exploit code

CVE-2002-1165

Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after (1) "||" sequences or (2) "/" characters, which are not properly filtered or verified.

Affected products

VendorProductAffected versions
SendmailSendmail
Versions 8.12.0, 8.12.1, 8.12.2, 8.12.3, 8.12.4, 8.12.5
NetbsdNetbsd
Versions 1.5, 1.5.1, 1.5.2, 1.5.3, 1.6

References