Sendmail CVE-2009-4565 CERT

[DShinn]

Does anyone know what the plan is to address this CERT?

Thank-you,

Dorothy

[Steven E. Protter]

Shalom Dorothy,

HP addresses all important CERT warnings on sendmail.

The initial response is usually a replacement for the sendmail binary file. It is then followed up, sometimes much later with a new depot based release of sendmail.

SEP

[DShinn]

Thank-you for the information! Probably the latest CERT will be addressed within a timely manner?

[Mark Nierth · Accepted solution]

Hi Dorothy,
I opened a case with HP on this CVE last month and here is their response.

I looked into the new vulnerability, CVE-2009-4565. I checked with our Level 3 group and it is a new issue. A new Service Request was started for this vulnerability and a CR, QXCR1001004856 was created. They are working on a fix.



The Level 3 people did tell me that if not using TLS / STARTLS there is no possibility of an exploit.

As of yet, I haven't seen a fix yet.

Mark

[DShinn]

Mark,

Thank-you for posting the information! Will pass along this information to my management.

Thanks again!

Dorothy