Description
Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after (1) "||" sequences or (2) "/" characters, which are not properly filtered or verified.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sendmail | 8.12.3-5 | — |
| Debian 13 | sendmail | 8.12.3-5 | — |
| Debian 12 | sendmail | 8.12.3-5 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Sendmail 8.12.x - SMRSH Double Pipe Access Validation EDB-21884 · local · Oct 1, 2002 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- RHSA-2003:073 vendor-advisory
- CLA-2002:532 vendor-advisory
- 20021001 iDEFENSE Security Advisory 10.01.02: Sendmail smrsh bypass vulnerabilities mailing-list
- sendmail-forward-bypass-smrsh(10232) vdb-entry
- MDKSA-2002:083 vendor-advisory
- http://www.sendmail.org/smrsh.adv.txt
- 5845 vdb-entry
- 7826 third-party-advisory