Vulnerability Report

CVE-2002-1337

Title: Sendmail buffer overflow RCE via formatted address fields

Memory Corruption

Proof Of Concept

PoC Available for CVE-2002-1337

CWE Category CWE-120
Published Date Mar 07, 2003
Modified Date Jun 16, 2026
Exploit Status Available
Score 10.0 CVSS v2.0
Exploit Probability (EPSS)
72.20%

Vulnerability Summary

CVE-2002-1337: Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.

Impacted Vendors

E
eric_allman 1
M
metainfo 1
S
sendmail 1
H
hp 1
R
redhat 1

Reference Links

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-002.txt.asc ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.6 ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.5 ftp://patches.sgi.com/support/free/security/advisories/20030301-01-P http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000571 http://frontal2.mandriva.com/security/advisories?name=MDKSA-2003:028 http://marc.info/?l=bugtraq&m=104673778105192&w=2 http://marc.info/?l=bugtraq&m=104678739608479&w=2 http://marc.info/?l=bugtraq&m=104678862109841&w=2 http://marc.info/?l=bugtraq&m=104678862409849&w=2 http://marc.info/?l=bugtraq&m=104679411316818&w=2 http://www-1.ibm.com/support/search.wss?rs=0&q=IY40500&apar=only http://www-1.ibm.com/support/search.wss?rs=0&q=IY40501&apar=only http://www-1.ibm.com/support/search.wss?rs=0&q=IY40502&apar=only http://www.cert.org/advisories/CA-2003-07.html http://www.debian.org/security/2003/dsa-257 http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21950 http://www.iss.net/security_center/static/10748.php http://www.kb.cert.org/vuls/id/398025 http://www.redhat.com/support/errata/RHSA-2003-073.html http://www.redhat.com/support/errata/RHSA-2003-074.html http://www.redhat.com/support/errata/RHSA-2003-227.html http://www.securityfocus.com/bid/6991 http://www.sendmail.org/8.12.8.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2222 ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-002.txt.asc ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.6 ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.5 ftp://patches.sgi.com/support/free/security/advisories/20030301-01-P http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000571 http://frontal2.mandriva.com/security/advisories?name=MDKSA-2003:028 http://marc.info/?l=bugtraq&m=104673778105192&w=2 http://marc.info/?l=bugtraq&m=104678739608479&w=2 http://marc.info/?l=bugtraq&m=104678862109841&w=2 http://marc.info/?l=bugtraq&m=104678862409849&w=2 http://marc.info/?l=bugtraq&m=104679411316818&w=2 http://www-1.ibm.com/support/search.wss?rs=0&q=IY40500&apar=only http://www-1.ibm.com/support/search.wss?rs=0&q=IY40501&apar=only http://www-1.ibm.com/support/search.wss?rs=0&q=IY40502&apar=only http://www.cert.org/advisories/CA-2003-07.html http://www.debian.org/security/2003/dsa-257 http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21950 http://www.iss.net/security_center/static/10748.php http://www.kb.cert.org/vuls/id/398025 http://www.redhat.com/support/errata/RHSA-2003-073.html http://www.redhat.com/support/errata/RHSA-2003-074.html http://www.redhat.com/support/errata/RHSA-2003-227.html http://www.securityfocus.com/bid/6991 http://www.sendmail.org/8.12.8.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2222
CVSS v2.0
Source Entity [email protected]
Severity HIGH
10.0
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:L/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2002-1337 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/411
View Code
Exploit-DB https://www.exploit-db.com/exploits/22313
View Code
Exploit-DB https://www.exploit-db.com/exploits/22314
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A
Complexity N/A
Privileges N/A
Interaction NONE
CVSS Vector String AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected Stack

No specific products linked.