Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
SMTP:COMMAND:ETRN |
|---|---|
Severity |
Major |
Recommended |
No |
Recommended Action |
Drop |
Category |
SMTP |
Keywords |
"ETRN" Command |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-11.4+, srx-12.1+, srx-branch-12.1+, vmx-17.4+, vsrx-12.1+, vsrx3bsd-18.2+ |
SMTP: "ETRN" Command
This signature detects attempts to exploit a known vulnerability against the ETRN command in Sendmail. When the SMTP server receives a remote ETRN command, the fork() is called and sleeps for five seconds. Attackers can connect, send large amounts of ETRN commands to the Sendmail server, and then disconnect to overload system resources and cause a denial-of-service condition.
Extended Description
There is a low-bandwidth dos vulnerability in Sendmail. When a client connects to the sendmail smtpd and sends an ETRN command to the server, the server fork()s and sleeps for 5 seconds. If many ETRN commands are sent to a server, it is possible to exhaust system resources and cause a denial of service or even a reboot of the server.
Affected Products
- Eric_allman sendmail 8.9.1
- Eric_allman sendmail 8.9.3
References
- BugTraq: 904
- CVE: CVE-1999-1109
- URL: http://archives.neohapsis.com/archives/bugtraq/1999-q4/0466.html