Re: Sendmail MIME DoS vulnerability

[Claus Assmann <ca+bugtraq@xxxxxxxxxxxxxxxxxx>]

On Tue, Jun 20, 2006, Jain, Siddhartha wrote:

> The description says that the DoS occurs when sendmail goes in a deeply
> nested malformed MIME message and uses the MIME 8-bit to 7-bit
> conversion function. Under what conditions would sendmail use the MIME
> 8-bit to 7-bit function? Only when the remote MTA doesn't understand
> 8-bit MIME, right?

See the RELEASE_NOTES:

        A malformed MIME structure with many parts can cause sendmail to
                crash while trying to send a mail due to a stack overflow,
                e.g., if the stack size is limited (ulimit -s).  This
                happens because the recursion of the function mime8to7()
                was not restricted.  The function is called for MIME 8 to
                7 bit conversion and also to enforce MaxMimeHeaderLength.
                                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^
                To work around this problem, recursive calls are limited to
                a depth of MAXMIMENESTING (20); message content after this
                limit is treated as opaque and is not checked further.

For details see sendmail/deliver.c, just search for mime8to7().