What’s Vulnerable › Vulnerabilities

CVE-2002-1337

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 72.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2003-03-07 · updated 2026-06-16
• Weakness: CWE-120

Description

Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.

Affected products

• gentoo Linux: 1.4-rc1, 1.4-rc2
• HP Alphaserver Sc: all versions
• Hewlett Packard Enterprise (HPE) HP-UX: 10.10, 10.20, 11.00, 11.0.4, 11.11, 11.22
• Netbsd: 1.5, 1.5.1, 1.5.2, 1.5.3, 1.6
• Oracle Corporation Solaris Operating System: 2.6, 7.0, 8, 9
• Sendmail: before 8.9.3; from 8.10.0 before 8.11.6; from 8.12.0 before 8.12.8 — fixed in 8.11.6, 8.12.8, 8.9.3
• Sunos: 5.7, 5.8
• Windriver Bsdos: 4.2, 4.3.1, 5.0
• Windriver Platform Sa: 1.0

How to fix

Upgrade to a fixed version: Sendmail 8.11.6, 8.12.8, 8.9.3. Check the vendor advisory for mitigations.

References

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000571
• http://frontal2.mandriva.com/security/advisories?name=MDKSA-2003:028
• http://marc.info/?l=bugtraq&m=104673778105192&w=2
• http://marc.info/?l=bugtraq&m=104678739608479&w=2
• http://marc.info/?l=bugtraq&m=104678862109841&w=2
• http://marc.info/?l=bugtraq&m=104678862409849&w=2
• http://marc.info/?l=bugtraq&m=104679411316818&w=2
• http://www-1.ibm.com/support/search.wss?rs=0&q=IY40500&apar=only

Get alerted when CVE-2002-1337 or the next vulnerability affects your stack