Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 18 articles for you...
74
sendmailinternal securityemail filterSendmail Configurations for ILOVEYOU Worm Protection Guide
Included here is information that can be added to your sendmail configuration to protect your internal users from the ILOVEYOU worm from spreading, as well as more information from this bugtraq post. Be sure to note that variations . . . . Included here is information that can be added to your sendmail configuration to protect your internal users from the ILOVEYOU worm from spreading, as well as more information from this bugtraq post. Be sure to note that variations are already appearing. This bugtraq post points out a variation, as well as a procmail filter, filters for Postfix, ideas from Sendmail.com, and other great information to put this damn thing to rest. The link for this article located at Jose Nazario / bugtraq is no longer available. . Protect your sendmail setup against the ILOVEYOU worm by modifying MIME settings, filtering attachments, enhancing access control, and educating users. sendmail configurations, ILOVEYOU worm, email security measures. . Anthony Pell
Nov 10, 2023
•
Network Security
77
security advisorysecurity issuebuffer overflowDisabling Sendmail: Address Buffer Overflow Risk on UNIX Systems
The Sendmail buffer overflow exploit announced in March will almost certainly be programmed into an automated worm within the next six months. Such a worm could do for UNIX systems what Code Red did to the Windows world -- simply because there are so many potentially vulnerable UNIX systems on the network today. . . .. The Sendmail buffer overflow exploit announced in March will almost certainly be programmed into an automated worm within the next six months. Such a worm could do for UNIX systems what Code Red did to the Windows world -- simply because there are so many potentially vulnerable UNIX systems on the network today. Shutting off the Sendmail daemon on 99.9% of the systems in your environment would greatly reduce the potential impact of such a worm. The Role of the Sendmail Daemon When I discuss security issues with systems administrators, I find that many of them are confused about the need for a running Sendmail daemon on their systems. This confusion is understandable since, for at least the last two decades, the commercial UNIX vendors have been shipping their operating systems with active Sendmail daemons in the default install. Most administrators simply assume that this daemon is necessary for the users and automated processes running on the system to be able to emit email from the machine. The reality, however, is that the Sendmail daemon on a machine is only responsible for two things: Listening on port 25/tcp for incoming messages from outside of the machine Flushing the local queue of unsent messages on a periodic basis Having a Sendmail daemon listening on 25/tcp opens the system up for remote exploits such as the recently announced buffer overflow issue. Note that the system only needs to be listening on 25/tcp if it is actively expecting to receive email messages from other systems. In fact, the only systems on the network that receive external email are the machines that are acting as mail servers and mail relays. A given site will typically only have a small handful ofthese machines (many of which are Windows machines running Exchange anyway). The other 99.9% of the systems on the network are email "clients" -- that is they may emit email messages from time to time, but never expect to receive a message from another machine. On these machines, it is probably best to simply disable the Sendmail daemon altogether in order to eliminate the potential for remote exploits. The link for this article located at SysAdmin is no longer available. . Reduce vulnerabilities stemming from the Sendmail buffer overflow by disabling Sendmail functionalities on non-essential systems to bolster security.. Sendmail Exploit, UNIX Security, Buffer Overflow Prevention, Email Daemon Risks. . LinuxSecurity.com Team
Jun 09, 2003
•
Server Security
77
security advisorybuffer overflowcriticalSendmail Version 8.12.9 Faces Critical Buffer Overflow Vulnerability
Sendmail, Inc., and the Sendmail Consortium announce the availability of sendmail 8.12.9. It contains a fix for a critical security problem discovered by Michal Zalewski whom we thank for bringing this problem to our attention. Sendmail urges all users to either upgrade to sendmail 8.12.9 or apply a patch for your sendmail version that is part of this announcement.. . .. Sendmail, Inc., and the Sendmail Consortium announce the availability of sendmail 8.12.9. It contains a fix for a critical security problem discovered by Michal Zalewski whom we thank for bringing this problem to our attention. Sendmail urges all users to either upgrade to sendmail 8.12.9 or apply a patch for your sendmail version that is part of this announcement. Remember to check the PGP signatures of patches or releases obtained via FTP or HTTP (to check the correctness of the patches in this announcement please verify the PGP signature of it). For those not running the open source version, check with your vendor for a patch. Visit Sendmail Open Source - Open Source Email Server | Proofpoint US for full information. We apologize for releasing this information today (2003-03-29) but we were forced to do so by an e-mail on a public mailing list (that has been sent by an irresponsible individual) which contains information about the security flaw. For a complete list of changes see the release notes down below. Please send bug reports to sendmail-bugs@sendmail.org as usual. Note: We have changed the way we digitally sign the source code distributions to simplify verification: in contrast to earlier versions two .sig files are provided, one each for the gzip'ed version and the compressed version. That is, instead of signing the tar file, we sign the compressed/gzip'ed files, so you do not need to uncompress the file before checking the signature. This version can be found at .sig and the usual mirror sites. MD5 signatures: 3dba3b6d769b3681640d0a38b0eba48c sendmail.8.12.9.tar.gz 19e39c9e9bc8fae288245c546639e1f4 sendmail.8.12.9.tar.gz.sig 268fc4045ba3eac6dfd9dc95d889ba5f sendmail.8.12.9.tar.Z 19e39c9e9bc8fae288245c546639e1f4 sendmail.8.12.9.tar.Z.sig You either need the first two files or the third and fourth, i.e., the gzip'ed version or the compressed version and the corresponding .sig file. The PGP signature was created using the Sendmail Signing Key/2003, available on the web site (https://www.proofpoint.com/us/products/email-protection/open-source-email-solution) or on the public key servers. Since sendmail 8.11 and later includes hooks to cryptography, the following information from OpenSSL applies to sendmail as well. PLEASE REMEMBER THAT EXPORT/IMPORT AND/OR USE OF STRONG CRYPTOGRAPHY SOFTWARE, PROVIDING CRYPTOGRAPHY HOOKS OR EVEN JUST COMMUNICATING TECHNICAL DETAILS ABOUT CRYPTOGRAPHY SOFTWARE IS ILLEGAL IN SOME PARTS OF THE WORLD. SO, WHEN YOU IMPORT THIS PACKAGE TO YOUR COUNTRY, RE-DISTRIBUTE IT FROM THERE OR EVEN JUST EMAIL TECHNICAL SUGGESTIONS OR EVEN SOURCE PATCHES TO THE AUTHOR OR OTHER PEOPLE YOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO ANY EXPORT/IMPORT AND/OR USE LAWS WHICH APPLY TO YOU. THE AUTHORS ARE NOT LIABLE FOR ANY VIOLATIONS YOU MAKE HERE. SO BE CAREFUL, IT IS YOUR RESPONSIBILITY. SENDMAIL RELEASE NOTES $Id: RELEASE_NOTES,v 8.1340.2.132 2003/03/29 14:02:26 ca Exp $ This listing shows the version of the sendmail binary, the version of the sendmail configuration files, the date of release, and a summary of the changes in that release. 8.12.9/8.12.9 2003/03/29 SECURITY: Fix a buffer overflow in address parsing due to a char to int conversion problem which is potentially remotely exploitable. Problem found by Michal Zalewski. Note: an MTA that is not patched might be vulnerable to data that it receives from untrusted sources, which includes DNS. To provide partial protection to internal, unpatched sendmail MTAs, 8.12.9 changes by default (char)0xff to (char)0x7fin headers etc. To turn off this conversion compile with -DALLOW_255 or use the command line option -d82.101. To provide partial protection for internal, unpatched MTAs that may be performing 7-> 8 or 8-> 7 bit MIME conversions, the default for MaxMimeHeaderLength has been changed to 2048/1024. Note: this does have a performance impact, and it only protects against frontal attacks from the outside. To disable the checks and return to pre-8.12.9 defaults, set MaxMimeHeaderLength to 0/0. Do not complain about -ba when submitting mail. Problem noted by Derek Wueppelmann. Fix compilation with Berkeley DB 1.85 on systems that do not have flock(2). Problem noted by Andy Harper of Kings College London. Properly initialize data structure for dns maps to avoid various errors, e.g., looping processes. Problem noted by Maurice Makaay. CONFIG: Prevent multiple application of rule to add smart host. Patch from Andrzej Filip. CONFIG: Fix queue group declaration in MAILER(`usenet'). CONTRIB: buildvirtuser: New option -t builds the virtusertable text file instead of the database map. Portability: Revert wrong change made in 8.12.7 and actually use the builtin getopt() version in sendmail on Linux. This can be overridden by using -DSM_CONF_GETOPT=0 in which case the OS supplied version will be used. Instructions to extract and apply the patches for sendmail: The data below is a uuencoded, gzip'ed tar file. Store the data between "========= begin patch ========" and "========= end patch ==========" into a file called "patch.sm" and apply the following command: uudecode -p > patch.sm | gunzip -c | tar -xf - This will give you these files (explanation for each file is on the left, only "prescan.VERSION.patch" are the files). prescan.8.12.8.patch only for 8.12.8, changes version string to 8.12.8p1 prescan.8.12.patch for 8.12.0 - 8.12.7, does not change version string prescan.8.11.6.patch only for 8.11.6, changes version string to8.11.6p2 prescan.8.11.patch for 8.11.0 - 8.11.5, does not change version string prescan.8.9.3.patch only for 8.9.3, changes version string to 8.9.3p2 prescan.8.9.patch for 8.9.0 - 8.9.2, does not change version string Apply the appropriate patch to your version of the sendmail source code (change the version number below to the right one!), e.g., cd sendmail-8.12.8/sendmail patch > prescan.8.12.8.patch recompile sendmail, and install the new binary. . Sendmail, Inc., and the Sendmail Consortium announce the availability of sendmail 8.12.9. It contain. sendmail, consortium, announce, availability, contain. . LinuxSecurity.com Team
Mar 31, 2003
•
Server Security
78
security advisorybuffer overflowsendmailSendmail: Buffer Overflow Advisory: Collaborative Security Response
Several users welcomed the growing willingness of vendors and security researchers to work together to identify and fix software vulnerabilities in the wake of last week's disclosure of a major hole in a widely used e-mail protocol .. . .. Several users welcomed the growing willingness of vendors and security researchers to work together to identify and fix software vulnerabilities in the wake of last week's disclosure of a major hole in a widely used e-mail protocol . But they also expressed concern over the practice by some in the security community to release vulnerability information to certain users before making it available to the public. Atlanta-based security vendor Internet Security Systems Inc. (ISS) and Emeryville, Calif.-based Sendmail Inc. last week disclosed the existence of a major buffer-overflow vulnerability in the sendmail mail-transfer agent, which handles more than 50% of all Internet e-mail traffic. The link for this article located at Computerworld is no longer available. . Numerous individuals recognized the growing partnership among suppliers and security experts to address weaknesses.. Software Vulnerabilities,Bug Disclosure,Incident Response,Security Collaboration. . LinuxSecurity.com Team
Mar 12, 2003
•
Vendors/Products
77
security advisorysecurity issuebuffer overflowSendmail: Buffer Overflow Risk Moderate: Potential Malware Exploit
A serious buffer overflow vulnerability announced last week in Sendmail is ripe to be exploited by targeted attacks, but it is also possible for a worm writer to write malicious code that exploits the security hole. No one can say whether a worm writer will create malware that targets the Sendmail flaw, but it is possible, experts said. The pervasiveness of the flaw and of Sendmail usage are strong reasons to be wary of the potential for such a worm. . . .. A serious buffer overflow vulnerability announced last week in Sendmail is ripe to be exploited by targeted attacks, but it is also possible for a worm writer to write malicious code that exploits the security hole. No one can say whether a worm writer will create malware that targets the Sendmail flaw, but it is possible, experts said. The pervasiveness of the flaw and of Sendmail usage are strong reasons to be wary of the potential for such a worm. Conservative estimates say that Sendmail, an open-source mail transport engine, handles between 50% to 75% of all Internet e-mail traffic. Most versions of the application, which can run on Unix, Linux and Windows, are susceptible to the buffer overflow vulnerability. An attacker could exploit the flaw in a targeted way by sending an e-mail message with a specially crafted header. The buffer is static, so if an attacker sends a certain size chunk of data, then some would spill over and run on the affected system. The link for this article located at Search Security is no longer available. . A critical memory corruption flaw in Postfix may result in focused intrusions or harmful software leveraging.. Sendmail Vulnerability, Buffer Overflow Threat, Email Security Issue, Malicious Code Exploit. . LinuxSecurity.com Team
Mar 12, 2003
•
Server Security
83
security advisorysendmailexploit riskSendmail And Snort Exploit Risks Reported: IT Threats Identified
Vulnerabilities have been uncovered in Sendmail and the Snort open source intrusion detection system IT departments suffered two serious vulnerabilities in enterprise-grade open source software systems last week. Top of the list was a newly reported vulnerability in Sendmail, which is a widely used mail transport agent (MTA). The second vulnerability was found in Snort, a popular open-source intrusion detection system (IDS). . . .. Vulnerabilities have been uncovered in Sendmail and the Snort open source intrusion detection system IT departments suffered two serious vulnerabilities in enterprise-grade open source software systems last week. Top of the list was a newly reported vulnerability in Sendmail, which is a widely used mail transport agent (MTA). The second vulnerability was found in Snort, a popular open-source intrusion detection system (IDS). Last week showed how quickly news of vulnerabilities can be exploited to produce software that wreaks havoc on the Net. Within 24 hours of the problems being made public, an easy-to-use exploit program for the Sendmail vulnerability was posted on the Bugtraq mailing list. According to Bugtraq, default installations of Sendmail and Red Hat Linux are not vulnerable to this particular exploit, but firms that have compiled Sendmail for use with Red Hat 7.1, 72 or 7.3 are vulnerable. The link for this article located at vnunet is no longer available. . Vulnerabilities have been uncovered in Sendmail and the Snort open source intrusion detection system. vulnerabilities, uncovered, sendmail, snort, source, intrusion, detection, system. . LinuxSecurity.com Team
Mar 11, 2003
•
Hacks/Cracks
77
security advisorycriticalremote accessSendmail Urgent Notification: Remote Access Security Risk 03-2003
A new critical vulnerability has been discovered in Sendmail. The UNIX and Linux vendors have been working feverishly to get a patch ready and most are available now. Sendmail is too big a target for attackers to ignore, so it makes sense to act immediately to protect your systems. Also, nice outline of how the whole disclosure was performed between countries, distributions, state and country agencies, and the vendor. . . .. A new critical vulnerability has been discovered in Sendmail. The UNIX and Linux vendors have been working feverishly to get a patch ready and most are available now. Sendmail is too big a target for attackers to ignore, so it makes sense to act immediately to protect your systems. Also, nice outline of how the whole disclosure was performed between countries, distributions, state and country agencies, and the vendor. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SANS Alert 2003-03-03 Critical vulnerability in all versions of SENDMAIL Plus a Snort Vulnerability And an invitation to a web broadcast on the vulnerabilities The Sendmail Vulnerability What systems are affected? UNIX and Linux Systems running sendmail - probably even those that are not mail servers. Level: CRITICAL - affords root or superuser access when sendmail is running with those privileges. A new critical vulnerability has been discovered in Sendmail. The UNIX and Linux vendors have been working feverishly to get a patch ready and most are available now. Sendmail is too big a target for attackers to ignore, so it makes sense to act immediately to protect your systems. In this note you will find: (1) The invitation to the webcast covering both vulnerabilities (2) DHS/NIPC Advisory 03-004 Remote Sendmail Header Processing Vulnerability (3) A description of what government and industry did to try to mitigate damage from this newly discovered vulnerability. (4) The Department of Homeland Security Alert on the Snort Vulnerability ******************************************************** SANS WebBroadcast (free) on the Sendmail Vulnerability and the Snort Vulnerability Date: March 3, 2003 (today) Time: 7 PM EST (0000 UTC) Register at: There is an absolute limit of 2,000 people on the live program to ensure quality audio, but the archive will be available about 5 hours later for anyone who does not get a reservation. Featuring the ISS X-Force folks (ISS discovered the vulnerability), Hal Pomeranz (sendmail expert) and Marty Roesch, author of Snort, will brief you on the Snort vulnerability. Below you'll find the Department of Homeland Security advisory followed by a brief description of what happened behind the scenes inside the government followed by the DHS Snort vulnerability alert. *********************************************************************** Here's the DHS/NIPC Advisory Remote Sendmail Header Processing Vulnerability SUMMARY: The Department of Homeland Security (DHS), National Infrastructure Protection Center (NIPC) is issuing this advisory to heighten awareness of the recently discovered Remote Sendmail Header Processing Vulnerability (CAN-2002-1337). NIPC has been working closely with the industry on vulnerability awareness and information dissemination. The Remote Sendmail Header Processing Vulnerability allows local and remote users to gain almost complete control of a vulnerable Sendmail server. Attackers gain the ability to execute privileged commands using super-user (root) access/control. This vulnerability can be exploited through a simple e-mail message containing malicious code. Sendmail is the most commonly used Mail Transfer Agent and processes an estimated 50 to 75 percent of all Internet e-mail traffic. System administrators should be aware that many Sendmail servers are not typically shielded by perimeter defense applications. A successful attacker could install malicious code, run destructive programs and modify or delete files. Additionally, attackers may gain access to other systems thru a compromised Sendmail server, depending on local configurations.Sendmail versions 5.2 up to 8.12.8 are known to be vulnerable at this time. DESCRIPTION: The Remote Sendmail Header Processing Vulnerability is exploited during the processing and evaluation of e-mail header fields collected during an SMTP transaction. Examples of these header fields are the "To", "From" and "CC" lines. The crackaddr() function in the Sendmail headers.c file allows Sendmail to evaluate whether a supplied address or list of addresses contained in the header fields is valid. Sendmail uses a static buffer to store processed data. It detects when the static buffer becomes full and stops adding characters. However, Sendmail continues processing data and several security checks are used to ensure that characters are parsed correctly. The vulnerability allows a remote attacker to gain access to the Sendmail server by sending an e-mail containing a specially crafted address field which triggers a buffer overflow. RECOMMENDATION: Due to the seriousness of this vulnerability, the NIPC is strongly recommending that system administrators who employ Sendmail take this opportunity to review the security of their Sendmail software and to either upgrade to Sendmail 8.12.8 or apply the appropriate patch for older versions as soon as possible. Patches for the vulnerability are available from Sendmail, from ISS who discovered the vulnerability and from vendors whose applications incorporate Sendmail code, including IBM, HP, SUN, Apple and SGI. Other vendors will release patches in the near future. The primary distribution site for Sendmail is: https://www.proofpoint.com/us/products/email-protection/open-source-email-solution Patches and information are also available from the following sites: The ISS Download center IBM Corporation https://www.ibm.com/mysupport/s/?language=en_US Hewlett-Packard , Co. https://www.hp.com/us-en/home.html Silicon Graphics Inc. Apple Computer, Inc. https://www.apple.com/ Sun Microsystems, Inc. https://www.oracle.com/it-infrastructure/ Common Vulnerabilities and Exposure(CVE) Project https://www.cve.org As always, computer users are advised to keep their anti-virus and systems software current by checking their vendor's web sites frequently for new updates and to check for alerts put out by the DHS/NIPC, CERT/CC, ISS and other cognizant organizations. The DHS/NIPC encourages recipients of this advisory to report computer intrusions to their local FBI office () and other appropriate authorities. Recipients may report incidents online to . The DHS/NIPC Watch and Warning Unit can be reached at (202) 323-3204/3205/3206 or
Mar 03, 2003
•
Server Security
83
security advisorytcpdumpsendmailTrojan Horse Impact on Sendmail, OpenSSH, and tcpdump Software
At least three commonly used open source software packages were altered by black-hat (bad-guy) hackers to contain "Trojan horse" code this year. The three most commonly used packages affected were Sendmail, OpenSSH and tcpdump/libpcap. Others to be modified included BitchX, . . . . At least three commonly used open source software packages were altered by black-hat (bad-guy) hackers to contain "Trojan horse" code this year. The three most commonly used packages affected were Sendmail, OpenSSH and tcpdump/libpcap. Others to be modified included BitchX, a chat client, and Fragrouter, a network security tool. In all of these cases, the unknown cracker gained entry to the relevant download sites and embedded the back door code in the installation packages. The link for this article located at ZDNet.com.au is no longer available. . At least three commonly used open source software packages were altered by black-hat (bad-guy) hacke. least, three, commonly, source, software, packages, altered, black-hat, (bad-guy), hacke. . LinuxSecurity.com Team
Dec 27, 2002
•
Hacks/Cracks
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!