Sendmail is prone to a security-bypass vulnerability because the application fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones. Successfully exploiting this issue allows attackers to perform man-in-the- middle attacks or impersonate trusted servers, which will aid in further attacks. Versions prior to Sendmail 8.14.4 are vulnerable.

Updates are available. Please see the references for more information.

• http://www.securityfocus.com/bid/37543
• http://www.sendmail.org/
• http://www.sendmail.org/releases/8.14.4

---

Updated on 2015-03-25