SSRT3631 Potential Security Vulnerability in sendmail Rev 3

[Berlene Herren]

A security bulletin has been issued:

-----------------------------------------------------------------
**REVISED 03**
Source: HEWLETT-PACKARD COMPANY
SECURITY BULLETIN: HPSBUX0309-281
Originally issued: 21 September 2003
Last revised: 10 November 2003
SSRT3631 Potential Security Vulnerability in sendmail
--------------------------------------------------

To access the bulletin from the itrc:

Select "maintenance and support"
Select "search technical knowledge base"
Select "HP-UX Software Security Bulletins"
Select "Search by Security Bulletin Number"
Enter â HPSBUX0309-281"
Search


===============================================================

Berlene

[Mark Greene_1]

If the above is referring to this security bulletin update I got today:

PROBLEM: Potential security vulnerability in sendmail

IMPACT: Potential unauthorized Privileged Access.

PLATFORM: HP-UX releases B.11.00, B.11.04 (VVOS), B.11.11, B.11.22

SOLUTION: Download and install HPSecurityBul281.depot.


Can you tell us if this requires are reboot? It does not say in the e-mail update.

Thanks,
mark

[Berlene Herren]

No Mark, there is no reboot.

Enjoy,
Berlene

[Berlene Herren]

If the files recommended in the Revision 2 of this bulletin have been installed there is no need to install HPSecurityBul281.depot. This depot is a repackaging of the previous files.


Berlene

[Jeff Schussele]

I would imagine that it would at least require sendmail to be bounced - correct Berlene?

Jeff

[Steven E. Protter]

Berlene,

How you doing?

I'm on the ftp site now.

The Bulliten says there should be a file called:HPSecurityBul281.depot.gz available.

Not there.

perhaps a permissions issue?

SEP

[Mark Greene_1]

Thanks for the confirmation. I suspect I still have to download this patch. I have these:

HPSecurityBul246.depot HPSecurityBul253.depot

but they are rev's 3 and 4, I think.

mark

[Berlene Herren]

Hi SEP, doing good! The .gz was just pulled for a packaging issue, it will be reposted shortly.

Yes Mark, you will need to Install the patches recommended in HPSBUX0304-253 first.

Berlene

[Berlene Herren]

The depot (HPSecurityBul281a.depot) is now back on the external site, cksum 2465545458 6041600.

Berlene

[Berlene Herren]

Jeff, I make it a practice to stop sendmail before installing a new or fixed version, then restarting it (if it didn't already start) after the patch/fix applied. But that's just my practice :-)

Berlene