CVE:CVE-2014-3956
CNNVD:CNNVD-201406-034
Sendmail是美国Sendmail公司的一款免费开源的邮件传输代理。
Sendmail 8.14.8及之前版本的conf.c文件中的‘sm_close_on_exec’函数存在安全漏洞，该漏洞源于执行程序之前，没有正确关闭文件说明符。本地攻击者可借助自定义的mail-delivery程序利用该漏洞操纵开放的SMTP连接。
solution:Upgrade freebsd freebsd to a higher version than 9.2,and avoid the version (,9.2]; Upgrade hp hpux to a higher version than b.11.31,and avoid the version (,b.11.31]; Upgrade fedoraproject fedora to a higher version than 20,and avoid the version 20; Upgrade sendmail sendmail to a higher version than 8.14.8,8.6.7,8.7.6,8.7.7,8.7.8,8.7.9,8.7.10,8.8.8,8.9.0,8.9.1,8.9.2,8.9.3,8.10,8.10.0,8.10.1,8.10.2,8.11.0,8.11.1,8.11.2,8.11.3,8.11.4,8.11.5,8.11.6,8.11.7,8.12.0,8.12.1,8.12.2,8.12.3,8.12.4,8.12.5,8.12.6,8.12.7,8.12.8,8.12.9,8.12.10,8.12.11,8.13.0,8.13.1,8.13.2,8.13.3,8.13.4,8.13.5,8.13.6,8.13.7,8.13.8,8.14.0,8.14.1,8.14.2,8.14.3,8.14.4,8.14.5,8.14.6,8.14.7,and avoid the version (,8.14.8],8.6.7,8.7.6,8.7.7,8.7.8,8.7.9,8.7.10,8.8.8,8.9.0,8.9.1,8.9.2,8.9.3,8.10,8.10.0,8.10.1,8.10.2,8.11.0,8.11.1,8.11.2,8.11.3,8.11.4,8.11.5,8.11.6,8.11.7,8.12.0,8.12.1,8.12.2,8.12.3,8.12.4,8.12.5,8.12.6,8.12.7,8.12.8,8.12.9,8.12.10,8.12.11,8.13.0,8.13.1,8.13.2,8.13.3,8.13.4,8.13.5,8.13.6,8.13.7,8.13.8,8.14.0,8.14.1,8.14.2,8.14.3,8.14.4,8.14.5,8.14.6,8.14.7