CVE-2003-0161

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 38.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2003-04-02 · updated 2026-06-16

Description

The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.

Affected products

Compaq Tru64: 4.0b, 4.0d, 4.0d_pk9_bl17, 4.0f, 4.0f_pk6_bl17, 4.0f_pk7_bl18 (+19)
Hewlett Packard Enterprise (HPE) HP-UX: 10.00, 10.01, 10.08, 10.09, 10.10, 10.16 (+10)
Hp-Ux Series 700: 10.20
Hp-Ux Series 800: 10.20
HP Sis: all versions
Sendmail: 2.6, 2.6.1, 2.6.2, 3.0, 3.0.1, 3.0.2 (+29)
Sendmail Switch: 2.1, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5 (+10)
Sun Solaris: 2.4, 2.5, 2.5.1, 2.6, 7.0, 8.0 (+2)
Sunos: 5.4, 5.5, 5.5.1, 5.7, 5.8

References

Get alerted when CVE-2003-0161 or the next vulnerability affects your stack