SSRT3631 Potential Security Vulnerability in sendmail Rev 2

[Berlene Herren]

A security bulletin revision has been issued:

-----------------------------------------------------------------
**REVISED 02**
Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0309-281
Originally issued: 21 September 2003
Last revised: 06 October 2003
SSRT3631 Potential Security Vulnerability in sendmail


-----------------------------------------------------------------

To access the bulletin from the itrc:

Select "maintenance and support"
Select "search technical knowledge base"
Select "HP-UX Software Security Bulletins"
Select "Search by Security Bulletin Number"
Enter " HPSBUX0309-281"
Search


===============================================================
This is specific to 11.22

Berlene

[Jeff Schussele]

Hi Berlene,

Am I the only one who thinks that if this pace keeps up on Sendmail alerts, I'm going to have to write a cron script to fetch 'em & apply 'em?

Rgds,
Jeff (tongue firmly planted in cheek)

Luckily no Itanium systems.....yet.....

[Geoff Wild]

Hi Berlene - what happened to your site:

http://www.geocities.com/berlene_herren/

Rgds...Geoff

[Berlene Herren]

Just trying to keep up with the Jones's :-)

Berlene

[Berlene Herren]

Geoff, in order to avoid a conflict between a personal site being viewed as somewhat official ( I DO work here ),I have removed it. Most of the links and material I had posted can be found from hp education and doing a google search on hp certification.

Thanks,
Berlene

[Geoff Wild]

Berlene - that's too bad :(

I even tried to find it in the Internet Archive:

http://www.archive.org/web/web.php

But alas, your site didn't make it to there....

RGds...Geoff

[Edward Finneran]

hmmmm...here's a question about HPSBUX0309-281. In the body, for hp-ux 11.0, it specifically states that the vulnerable fileset is SMAIL-811.

So, if we never loaded the 'webupgrade' from the version of sendmail that shipped with HP-UX and has been patched over the years, so we're running 8.9.3, this vulnerability would imply that it doesn't apply to us, since we don't have SMAIL-811.

However, the CERT page for the corresponding advisory says that this vulnerability applies to all versions of sendmail prior to 8.12 -- which would include 8.9.3, which would imply that we ARE vulnerable -- sendmail.org has a patch you can apply to all versions prior to 8.12.0 to fix it.

Which is correct? Are we vulnerable, or not?

[John Morris]

There are two vulnerable filesets for B.11.00:

HP-UX B.11.00
=============
SMAIL-811.INETSVCS-SMAIL
--> fix: install HPSecurityBul281b.depot

InternetSrvcs.INETSVCS-RUN
--> fix: install HPSecurityBul281b.depot

The InternetSrvcs.INETSVCS-RUN contains the 8.9.3 version of sendmail.

The HPSecurityBul281b.depot contains the following files:

sendmail.893.11.00.r4
sendmail.811.11.00.r4
sendmail.893.11.11.r4
sendmail.811.11.11.r4
sendmail.811.11.22.r5
sendmail.811.11.23.r1


John Morris
HP SOFTWARE SECURITY RESPONSE TEAM (SSRT)