Vulnerability in sendmail(1M) Versions Prior to 8.13.6 ??

[Sammy_2]

Got an email from my security dept. about this vulnerability. I got the patch for Solaris. But what is HPUX 11.11 equivalent of this patch. My sendmail version is


# what /usr/sbin/sendmail
/usr/sbin/sendmail:
Copyright (c) 1998 HEWLETT PACKARD COMPANY and its licensors,
including Sendmail, Inc., and the Regents of the
University of California. All rights reserved.
version.c 8.9.3.1 (Berkeley) 10/10/2003 (PHNE_29774)


Check these site for security vulnerability.

US-CERT Technical Cyber Security Alert TA06-081A:
http://www.us-cert.gov/cas/techalerts/TA06-081A.html

Sendmail MTA Security Vulnerability:
http://www.sendmail.com/company/advisory/

See also http://www.frsirt.com/english/advisories/2006/1049

[Steven E. Protter]

Shalom Sammy,

The vulnerability is in ALL sendmail versions before 8.13.3

HP may decide to release a patch versus a whole new sendmail, as may other vendors.

To deal with the vulnerability you must either upgrade sendmail or install a certified patch set.

SEP

[Arunvijai_4]

Hi Sammy,

Yes, This Vulnerability exists on all versions of Sendmail prior to 8.13.3. You can download the latest source from http://www.sendmail.org/8.13.6.html and install yourself.

-Arun

[Kent Ostby]

PHNE_29774 is the latest version of the 11.11 sendmail patch at this time.

[Kent Ostby]

Sammy --

You can go to this website and get a utility to run on your HP-UX box which will tell you all of the current security patches you need to install:

http://docs.hp.com/en/B2355-90950/ch08s19.html?jumpid=reg_R1002_USEN

[Kent Ostby]

Sorry.. that's the page that tells you how to run it.

The command should already be on your system.

[Steven E. Protter · Accepted solution]

Shalom again,

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=SMAIL813

This one is probably NOT vulnerable according to my reading of the docs.

SEP

[Sammy_2]

Thanks to all.
Does this mean HP (unlike Sun) does not have a patch to address this particular vulnerability issue ?
Kent,
does this new version of patch fix this particular problem ? At this porint, I don't want install all security patches but just this problem.
SEP,i am gathering that since we don;t have a patch we may have to upgrade sendmail by swremove old sendmail and
swintall new one.

[Sammy_2]

I am not running sendmail on any of our servers. So that is one better than actually installing a patch. All servers only send mails (no incoming) and thus dont need sendmail daemon. much safer.
Thanks toall