{"id":"CVE-2002-1337","aliases":["DEBIAN-CVE-2002-1337","DSA-257","EUVD-2002-1321","GHSA-2vpw-h4q9-62fp"],"status":"published","title":"Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via...","description":"Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.72644,"percentile":0.99448,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-120"],"published":"2003-03-04T00:00:00Z","modified":"2026-10-22T23:47:32Z","exploits":[{"source":"exploitdb","id":"EDB-22313","title":"Sendmail 8.12.x - Header Processing Buffer Overflow (1)","type":"remote","platform":"unix","date":"2003-03-02","verified":true,"url":"https://www.exploit-db.com/exploits/22313"},{"source":"exploitdb","id":"EDB-22314","title":"Sendmail 8.12.x - Header Processing Buffer Overflow (2)","type":"remote","platform":"unix","date":"2003-03-02","verified":true,"url":"https://www.exploit-db.com/exploits/22314"},{"source":"exploitdb","id":"EDB-411","title":"Sendmail 8.11.x (Linux/i386) - Local Privilege Escalation","type":"local","platform":"linux","date":"2001-01-01","verified":true,"url":"https://www.exploit-db.com/exploits/411"}],"fixes":[{"ecosystem":"Debian:12","package":"sendmail","fixed_in":["8.13.0.PreAlpha4-0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sendmail","fixed_in":["8.13.0.PreAlpha4-0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sendmail","fixed_in":["8.13.0.PreAlpha4-0"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"sendmail","fixed_in":["8.12.3-5"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"sendmail-wide","fixed_in":["8.12.3+3.5Wbeta-5.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.13.0.PreAlpha4-0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.13.0.PreAlpha4-0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.13.0.PreAlpha4-0"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.3-5"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"sendmail-wide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.3+3.5Wbeta-5.2"}]}]}],"products":[{"vendor":"gentoo","product":"linux"},{"vendor":"hp","product":"alphaserver_sc"},{"vendor":"hp","product":"hp-ux"},{"vendor":"netbsd","product":"netbsd"},{"vendor":"oracle","product":"solaris"},{"vendor":"sendmail","product":"sendmail"},{"vendor":"sun","product":"sunos"},{"vendor":"windriver","product":"bsdos"},{"vendor":"windriver","product":"platform_sa"}],"references":[{"url":"http://www.redhat.com/support/errata/RHSA-2003-073.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","web"]},{"url":"ftp://patches.sgi.com/support/free/security/advisories/20030301-01-P","tags":["vendor-advisory","x_refsource_SGI","x_transferred","Broken Link","advisory"]},{"url":"http://www-1.ibm.com/support/search.wss?rs=0\u0026q=IY40501\u0026apar=only","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","Broken Link","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=104678862109841\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.redhat.com/support/errata/RHSA-2003-227.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","web"]},{"url":"http://www.securityfocus.com/bid/6991","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Exploit","Patch","Third Party Advisory","VDB Entry","Vendor Advisory","advisory","evidence","fix","web"]},{"url":"http://www.kb.cert.org/vuls/id/398025","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"http://www.sendmail.org/8.12.8.html","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"http://www.debian.org/security/2003/dsa-257","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Broken Link","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=104678739608479\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2222","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","Broken Link","web"]},{"url":"http://www.redhat.com/support/errata/RHSA-2003-074.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","web"]},{"url":"http://www.cert.org/advisories/CA-2003-07.html","tags":["third-party-advisory","x_refsource_CERT","x_transferred","Broken Link","Patch","Third Party Advisory","US Government Resource","advisory","fix"]},{"url":"http://marc.info/?l=bugtraq\u0026m=104673778105192\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","advisory"]},{"url":"http://frontal2.mandriva.com/security/advisories?name=MDKSA-2003:028","tags":["vendor-advisory","x_refsource_MANDRAKE","x_transferred","Broken Link","advisory"]},{"url":"http://www-1.ibm.com/support/search.wss?rs=0\u0026q=IY40500\u0026apar=only","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","Broken Link","web"]},{"url":"http://www.iss.net/security_center/static/10748.php","tags":["vdb-entry","x_refsource_XF","x_transferred","Broken Link","web"]},{"url":"ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.6","tags":["vendor-advisory","x_refsource_CALDERA","x_transferred","Broken Link","web"]},{"url":"ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.5","tags":["vendor-advisory","x_refsource_CALDERA","x_transferred","Broken Link","web"]},{"url":"http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000571","tags":["vendor-advisory","x_refsource_CONECTIVA","x_transferred","Broken Link","web"]},{"url":"ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-002.txt.asc","tags":["vendor-advisory","x_refsource_NETBSD","x_transferred","Broken Link","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=104679411316818\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21950","tags":["third-party-advisory","x_refsource_ISS","x_transferred","Broken Link","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"http://www-1.ibm.com/support/search.wss?rs=0\u0026q=IY40502\u0026apar=only","tags":["vendor-advisory","x_refsource_AIXAPAR","x_transferred","Broken Link","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=104678862409849\u0026w=2","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-1337"},{"url":"https://github.com/advisories/GHSA-2vpw-h4q9-62fp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2002-1337","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2002-1337","description":"Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.","status":"published","published":"2004-09-01T04:00:00Z","modified":"2024-08-08T03:19:28.722Z","updated_at":"2026-11-02T14:33:54.972584Z"}],"euvd":[{"id":"EUVD-2002-1321","description":"Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.","status":"published","published":"2004-09-01T04:00:00Z","modified":"2024-08-08T03:19:28Z","updated_at":"2026-11-03T01:14:56.771794Z"}],"ghsa":[{"id":"GHSA-2vpw-h4q9-62fp","title":"Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via...","description":"Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.","status":"published","published":"2022-05-03T03:08:07Z","modified":"2023-02-01T05:01:05Z","updated_at":"2026-11-02T14:49:39.648637Z"}],"nvd":[{"id":"CVE-2002-1337","description":"Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.","status":"published","published":"2003-03-07T05:00:00Z","modified":"2026-06-16T21:59:07.767Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:00:44.251133Z"}],"osv":[{"id":"CVE-2002-1337","description":"Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.","status":"published","published":"2003-03-07T05:00:00Z","modified":"2026-04-10T03:33:22.871396Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"DEBIAN-CVE-2002-1337","description":"Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.","status":"published","published":"2003-03-07T05:00:00Z","modified":"2026-10-22T23:47:32.395223756Z","updated_at":"2026-11-02T15:45:22.248131Z"},{"id":"DSA-257","title":"sendmail - remote exploit","status":"published","published":"2003-03-04T00:00:00Z","modified":"2026-03-09T01:20:32.013489Z","updated_at":"2026-11-02T15:46:15.489951Z"}]}}