Although these reports have focused only on DNS, this vulnerability could apply to any network service from which data is received and subsequently used. Section III.A contains a pointer to two subroutines that address the DNS problem. This advisory speaks to a specific instance of a problem caused by the information returned by DNS, but information from any server should be checked for validity. Impact Programs that do not check data provided by information servers may operate in unpredictable ways and give unexpected results. In particular, exploitation of this vulnerability may allow remote access by unauthorized users.
Exploitation can also lead to root access by both local and remote users.
Solution For programs that you write or have written, consider integrating the general solution in Section A below. In the specific case of the sendmail mail delivery program, Eric Allman, the original author of sendmail, has produced patches that address the problem. Section B provides details about these, along with vendor information and additional steps you should take to protect sendmail. A. General solution for Internet host names Use the host name and IP address validation subroutines available at the locations listed below. Include them in all programs that use the result of the host name lookups in any way.