topic Re: Patch for sendmail for potential buffer overflow in Operating System - HP-UX

Patch for sendmail for potential buffer overflow

Jeny Joseph — Thu, 13 Nov 2003 12:14:53 GMT

Hi,

HP-UX 10.20
Sendmail version 8.8.6
For the potential buffer overflow security vulnerability in sendmail(CERT advisory CA-2003-25 and HP reference SSRT3631) is there a patch available for HP-UX 10.20 running sendmail version 8.8.6.

Thanks.
Jeny

Re: Patch for sendmail for potential buffer overflow

Steven E. Protter — Thu, 13 Nov 2003 12:19:45 GMT

Two problems:

The sendmail patches I've seen support sendmail 8.9 and up.

Of course HP-UX 10.20 is no longer supported though I thought important security patches would still happen.

You might want to go to http://www.sendmail.org download and compile a new sendmail on your system. You can go 8.12 and have better security than me.!!!

SEP

Re: Patch for sendmail for potential buffer overflow

Jeny Joseph — Thu, 13 Nov 2003 13:24:46 GMT

The first problem can be solved by applying an available patch to upgrade to sendmail 8.9.3.

So now I need to know if a patch is available for HP-UX 10.20 running sendmail 8.9.3. I saw documentation that a patch is available for HP-UX 11.0 and higher. No mention of 10.20. Does that mean no patch will be available for 10.20 since it is no longer supported?

Thanks.
Jeny

Re: Patch for sendmail for potential buffer overflow

Berlene Herren — Fri, 14 Nov 2003 05:58:36 GMT

Jeny, open a call with the response center for this one or email me with relative information. HP's policy is that it no longer issues patches for unsupported/obsolete operating system versions.

Berlene.herren@

Re: Patch for sendmail for potential buffer overflow

Clyde Mehornay Jr — Mon, 17 Nov 2003 13:08:34 GMT

This first showed up quite a while ago.

The HP Security Bulletin is HPSBUX0304-253, which is in reference to CERT Advisory CA-2003-12, CERT Vulnerability Note VU#897604.

In it, patch PHNE_28760 gets you to Sendmail 8.9.3 on HP-UX 10.20, including the fix for this problem. Read the entire bulletin, since this Sendmail change could affect normal operations involving normal users traversing mail queues.

Re: Patch for sendmail for potential buffer overflow

Tom Danzig — Mon, 17 Nov 2003 14:27:14 GMT

For HP-UX 10.20:

PHNE_28760 - sendmail(1m) 8.9.3 cumulative patch.

FYI, there is another sendmail advisory for which a patch has yet to be issued.

Re: Patch for sendmail for potential buffer overflow

Jeny Joseph — Tue, 25 Nov 2003 15:43:23 GMT

Thanks everybody for your responses.
I will follow Berlene Herren's suggestion.

Thanks again.