what output of new sendmail binary

[Gerald Miller_1]

I have installed the new sendmail binaries from HP according to the latest security bulletin, and have ensured that the cksum output is the same as what is noted in the same bulletin.

My question is, why is my `what` output dated 03/04/03 (see below)?

# what /usr/sbin/sendmail
/usr/sbin/sendmail:
Copyright (c) 1998 HEWLETT PACKARD COMPANY and its licensors,
including Sendmail, Inc., and the Regents of the
University of California. All rights reserved.
version.c 8.11.1 (Berkeley) - Revision 1.3_binary - 03/04/2003

[Ramkumar Devanathan]

Hi,

The what string is the string containing details such as above, and it is placed at the time of the build of the sources into the built libraries/executables.

I don't know why you should have a problem about the date? Can you explain?

What was the 'what' string earlier? is the date now newer than earlier 'what' string date?

- ramd.

[Geoff Wild]

I believe because that was the date of the patch...your output looks fine...

[Christopher Caldwell]

I think Gerald is pointing out is that the versioning information (obtained via what) for the recent sendmail patches doesn't make a lot of sense.

Since the patches are handled outside of SD-UX, it would be nice if the HP folks would include enough versioning information to understand when the binary was built or enough information [besides cksum] to know you're properly patched. (I hope this binary wasn't built on 3/4 since the vulnerability in question wasn't announced until 3/29).

It's easy to use what or SD-UX, to make sure your running the correct version. It's tedious to use cksum.

[W.C. Epperson]

EEK. You don't suppose they patched the binary with adb?

[Gerald Miller_1]

The issue here is that the what output does not make sense... why is the date 03/04/2003 when the this issue just surfaced about a week ago?

Unless HP has a Magic 8-Ball of Security Holes and made this patch a month in advance, this makes no sense. =)