PLEASE PATCH YOUR SENDMAIL!

[Berlene Herren]

This was reported by Dan Ingevaldson, team leader of X-Force research and development at ISS, who first discovered the vulnerability. http://www.linuxworld.com/go.cgi?id=741963

"What makes the new vulnerability particularly pernicious is that attackers would need to know little about the server they were attacking other than its Internet address.
It's quite a dangerous vulnerability because an exploit could be contained in the e-mail message itself. The attacker doesn't need to set up an elaborate system to launch the attack. They could just send an e-mail message to a server, and if the server is vulnerable the attack would be launched.

The combination of freely visible source code, a severe and remotely exploitable vulnerability, and an enormous installed base of vulnerable servers make the new Sendmail vulnerability an extremely high-value target for the hacking community, according to Ingevaldson.

That means that it is critical for affected organizations to patch their servers.

Once an exploit is published, all bets are off. The window of vulnerability has decreased. there have been some very robust powerful exploits released within a few months of the exploit being published, so if patching was not a big deal before, it is now."


Berlene

[Krishna Prasad]

Was this for all versions of Sendmail on all Operationg Systems?


The link only mentioned the Linux operating system.

[Berlene Herren]

Ron, a complete list can be found here:

http://www.cert.org/advisories/CA-2003-07.html

Berlene

[Steven E. Protter]

sendmail-8.11.6-15

vulnerable? Not?

RH 7.3 Intel

SEP

[Jon_87]

Any flavor of Unix needs to be patched. the group "LSD" has proven Tuesday to break into Redhat and Debian so far. All relevant patches are now available at:

Hewlett Packard: www.hp.com/support

IBM: www.ibm.com/support

RedHat Linux: www.redhat.com/apps/support/errata

SGI: support.sgi.com
Sun: sunsolve.sun.com/patches

SuSE Linux: /www.suse.com/us/private/support/security

Of course BSD and others also have patches avail, just do not have the links right here in front of me. I have seen that SuSE, Redhat, Connectiva, and Mandrake have these on thier FTPs now.