Vulnerability in Sendmail

CVE-1999-1580

SunOS sendmail 5.59 through 5.65 uses popen to process a forwarding host argument, which allows local users to gain root privileges by modifying the IFS (Internal Field Separator) variable and passing crafted values to the -oR option.

Published 1995-08-23 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 7.2 (High). Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.011 (64.4th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 64th percentile — 64.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.011 · newest: 0.011 · change: -0.000

Affected products

Sendmail — versions 5.59, 5.61, 5.65
Sun Sunos — versions 4.1.1, 4.1.2, 4.1.3

References

www.kb.cert.org/vuls/id/3278 (US Government Resource, Third Party Advisory, third-party-advisory)
www.cert.org/advisories/CA-95.11.sun.sendmail-oR.vul (US Government Resource, Patch, Third Party Advisory, third-party-advisory)
www.securityfocus.com/bid/7829 (vdb-entry)
www.auscert.org.au/render.html (Vendor Advisory, third-party-advisory)
www.alw.nih.gov/Security/8lgm/8lgm-Advisory-21.html (Exploit)