topic Re: Sendmail Vulnerability in Operating System - HP-UX

Sendmail Vulnerability

Venkatesan_5 — Tue, 25 Jan 2011 07:51:05 GMT

Hi, we have a HPUX11.31 server with SAP application running on it.

Issue details:
We are using Sendmail to receive incoming mails to SAP application. We have received Security Alert for sendmail from security team.

Alert: There is a bug in sendmail that can allow any body to send a crafted email with code that can give them root access.

we have sendmail version 8.13.34 loaded in 11.31.
)#what /usr/sbin/sendmail | grep version
Sendmail version 8.13.3 - Revision 1.003:: HP-UX11.31 - 8th December,2008

)#swlist -l product | grep -i send
Sendmail C.8.13.3.4 Mail Transfer Protocol daemons and utilities

Does this version still have this bug or do I need to update it to 8.13.3.5 as per the reference given below

https://h20392.www2.hp.com/portal/swdepot/displayInstallInfo.do?productNumber=SMAIL813

https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=SMAIL813

Kindly help me with your inputs...

Thanks in Advance.

Re: Sendmail Vulnerability

RickT_1 — Tue, 25 Jan 2011 14:13:02 GMT

This vulnerability only applies if you have STARTTLS enabled. I'm sending you the document so you can see exactly what the vulnerability is and decide how best to handle it. http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02009860

This should answer all of your questions.

Rick

Re: Sendmail Vulnerability

Rita C Workman — Tue, 25 Jan 2011 14:13:10 GMT

There was a fix done around mid-2010. Version 8.13.3.4.1.
So anything from this version...on will have the fix.

Regards,
Rita

Re: Sendmail Vulnerability

Zinky — Tue, 25 Jan 2011 17:46:37 GMT

Always HAVE the latest SendMail version as best practice. WHatever your OS vendor provides as the latest should always be on your system.

Or if you BUILD your own Sendmail, always build from the latest Sendmail.Org sources.

Re: Sendmail Vulnerability

Venkatesan_5 — Fri, 28 Jan 2011 09:45:09 GMT

Hi Rick,
As per your suggestion the tests are sucessful. We shall decide on updating it to the latest version.