CVE-2003-0688

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2003-10-20 · updated 2026-06-16

Description

The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect data.

Affected products

Compaq Tru64: 5.0a, 5.1
FreeBSD: 4.6, 4.7, 4.8, 5.0
OpenBSD: 3.2
RedHat Sendmail: 8.12.5-7, 8.12.8-4
Sendmail: 8.12.1, 8.12.2, 8.12.3, 8.12.4, 8.12.5, 8.12.6 (+2)
Sgi Irix: 6.5.19, 6.5.20, 6.5.21

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000727
http://www.kb.cert.org/vuls/id/993452
http://www.mandriva.com/security/advisories?name=MDKSA-2003:086
http://www.novell.com/linux/security/advisories/2003_035_sendmail.html
http://www.redhat.com/support/errata/RHSA-2003-265.html
http://www.sendmail.org/dnsmap1.html
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A597
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000727
http://www.kb.cert.org/vuls/id/993452
http://www.mandriva.com/security/advisories?name=MDKSA-2003:086

Get alerted when CVE-2003-0688 or the next vulnerability affects your stack