sendmail bug & no smtp

[Laszlo Csizmadia]

There is a sendmail bug announced on March 29: http://www.sendmail.com/security/index.shtml
Is there any patch provided by HP for that? The previous bug (March 3) was fixed but I didn't read anything about the second in the security bulletins. I mostly have sendmail version 8.9.3 (PHNE_24419+JAGae58098).
Is there a way to stop the sendmail smtp daemons only? Most of my machines are only sending mails (via smart host) and not excepted to recieve any. So no need to keep port 25 open, right?
Any help will be appreciated...

[John Poff]

Hi,

Take a look at this link for the latest sendmail patch
from HP:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xe37d7cffe265d711abdc0090277a778c,00.html

Here is a post from Berlene Herren with an excellent FAQ about the
sendmail patch:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xa4369607df6ed711abdc0090277a778c,00.html

One of the best ways to stay on top of HP related security issues is to
sign up for the security bulletins sent via e-mail from here on the ITRC.

JP

[Bill McNAMARA_1]

Security Bulletins:

http://itrc.hp.com/cki/bin/doc.pl/screen=ckiSecurityBulletin
Also watch out for Berlene Herrens ( http://forums.itrc.hp.com/cm/UserProfile/1,,CA483039!1,00.html )updates:
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xcf747cffe265d711abdc0090277a778c,00.html

Later,
Bill

[David_246]

Hi,

Just modify the file "/etc/rc.config.d/mailservs" and set it to :

export SENDMAIL_SERVER=0
export SENDMAIL_SERVER_NAME=

Add into cron :

1,6,11,16,21,26,31,36,41,46,51,56 * * * * /usr/sbin/sendmail -q

to empty the outgoing queue every 5 minutes.

Best Regs David

[Mark Greene_1]

There are currently two fixes for sendmail. Do a search on the hp site for each of the following:

HPSecurityBul246.depot HPSecurityBul253.depot


They have to be loaded in that order. There are two different problems that CERT found with sendmail, hence the two different fixes.

HTH
mark