Strix
26.1K

CVE-2014-3956

UnknownEPSS 0.63%

Last modified

CVE-2014-3956 is a vulnerability of currently unknown severity. The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.. EPSS estimates a 0.63% chance of exploitation in the next 30 days.

Description

The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.

Metrics

EPSS Probability
0.63%

45.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
FreebsdFreebsd<= 9.2
HpHpux<= b.11.31
FedoraprojectFedora20
SendmailSendmail<= 8.14.8
SendmailSendmail8.6.7
SendmailSendmail8.7.6
SendmailSendmail8.7.7
SendmailSendmail8.7.8
SendmailSendmail8.7.9
SendmailSendmail8.7.10
SendmailSendmail8.8.8
SendmailSendmail8.9.0
SendmailSendmail8.9.1
SendmailSendmail8.9.2
SendmailSendmail8.9.3
SendmailSendmail8.10
SendmailSendmail8.10.0
SendmailSendmail8.10.1
SendmailSendmail8.10.2
SendmailSendmail8.11.0
SendmailSendmail8.11.1
SendmailSendmail8.11.2
SendmailSendmail8.11.3
SendmailSendmail8.11.4
SendmailSendmail8.11.5
SendmailSendmail8.11.6
SendmailSendmail8.11.7
SendmailSendmail8.12.0
SendmailSendmail8.12.1
SendmailSendmail8.12.2
SendmailSendmail8.12.3
SendmailSendmail8.12.4
SendmailSendmail8.12.5
SendmailSendmail8.12.6
SendmailSendmail8.12.7
SendmailSendmail8.12.8
SendmailSendmail8.12.9
SendmailSendmail8.12.10
SendmailSendmail8.12.11
SendmailSendmail8.13.0
SendmailSendmail8.13.1
SendmailSendmail8.13.2
SendmailSendmail8.13.3
SendmailSendmail8.13.4
SendmailSendmail8.13.5
SendmailSendmail8.13.6
SendmailSendmail8.13.7
SendmailSendmail8.13.8
SendmailSendmail8.14.0
SendmailSendmail8.14.1

Showing 50 of 56 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2014-3956?
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.
How severe is CVE-2014-3956?
Severity scoring for CVE-2014-3956 is pending analysis. The EPSS model estimates a 0.63% probability of exploitation in the next 30 days.
How do I fix CVE-2014-3956?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2014

View all 2014CVEs →

Are you affected by CVE-2014-3956?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST