MNBSD-2014-6: Sendmail fails to set close-on-exec on file descriptors

Description

Sendmail failed to properly set the close-on-exec flag for open file descriptors. A local user could exploit the leaked descriptors passed to mail filters or delivery programs, potentially interfering with connections or gaining unintended access.

Affected Versions

sendmail

Recommendations

No specific recommendations provided.

References

• https://www.freebsd.org/security/advisories/FreeBSD-SA-14:11.sendmail.asc
• https://www.cve.org/CVERecord?id=CVE-2014-3956

Additional Information

Aliases: CVE-2014-3956

Published: June 04, 2014
Last Modified: June 04, 2014