On Tue, Jun 20, 2006, Jain, Siddhartha wrote: > The description says that the DoS occurs when sendmail goes in a deeply > nested malformed MIME message and uses the MIME 8-bit to 7-bit > conversion function. Under what conditions would sendmail use the MIME > 8-bit to 7-bit function? Only when the remote MTA doesn't understand > 8-bit MIME, right? See the RELEASE_NOTES: A malformed MIME structure with many parts can cause sendmail to crash while trying to send a mail due to a stack overflow, e.g., if the stack size is limited (ulimit -s). This happens because the recursion of the function mime8to7() was not restricted. The function is called for MIME 8 to 7 bit conversion and also to enforce MaxMimeHeaderLength. ^^^^^^^^^^^^^^^^^^^^^^^^^^^ To work around this problem, recursive calls are limited to a depth of MAXMIMENESTING (20); message content after this limit is treated as opaque and is not checked further. For details see sendmail/deliver.c, just search for mime8to7().
