From: Jeff Shultz 

Sendmail doesn't have exploits. Sendmail _is_ an exploit. Go Postfix.

Geo. wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
>
>
____________________________________________________________________________
> __
>
>                            SGI Security Advisory
>
>  Title:      sendmail prescan() vulnerability
>  Number:     20030903-01-P
>  Date:       September 29, 2003
>  Reference:  CERT CA-2003-25
>  Reference:  CAN-2003-0694
>  Reference:  SGI BUG 900772
>  Fixed in:   IRIX 6.5.22 or patches 5325 and 5326
>
____________________________________________________________________________
> __
>
>  SGI provides this information freely to the SGI user community for its
>  consideration, interpretation, implementation and use.   SGI recommends
>  that this information be acted upon as soon as possible.
>
>  SGI provides the information in this Security Advisory on an "AS-IS"
>  basis only, and disclaims all warranties with respect thereto, express,
>  implied or otherwise, including, without limitation, any warranty of
>  merchantability or fitness for a particular purpose.  In no event shall
>  SGI be liable for any loss of profits, loss of business, loss of data or
>
>  for any indirect, special, exemplary, incidental or consequential
>  damages
>  of any kind arising from your use of, failure to use or improper use of
>  any of the instructions or information in this Security Advisory.
>
____________________________________________________________________________
> _
>
> - -----------------------
> - --- Issue Specifics ---
> - -----------------------
>
>  It has been reported that under certain conditions a vulnerability in
>  sendmail could allow a remote attacker to execute arbitrary code with
>  the privileges of the sendmail daemon, typically root. This effects
>  all versions of sendmail including the latest version, 8.12.9.
>
>  For more details please see:
>  http://www.cert.org/advisories/CA-2003-25.html
>  http://www.kb.cert.org/vuls/id/784980
>
>
http://lists.netsys.com/pipermail/full-disclosure/2003-September/010287.html
>
>  The Common Vulnerabilities and Exposures project (cve.mitre.org) has
>  assigned the name CAN-2003-0694 to this issue:
>  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0694
>
>  SGI has investigated the issue and recommends the following steps for
>  neutralizing the exposure.  It is HIGHLY RECOMMENDED that these measures
>
>  be implemented on ALL vulnerable SGI systems.  This issue has been
>  corrected in future releases of IRIX.
>
>
> - --------------
> - --- Impact ---
> - --------------
>
>  sendmail is install by default on IRIX.
>
>  To determine the version of IRIX you are running, execute the following
>  command:
>
>    # /bin/uname -R
>
>  That will return a result similar to the following:
>
>    # 6.5 6.5.21f
>
>  The first number ("6.5") is the release name, the second
("6.5.21f" in
>  this case) is the extended release name.  The extended release name
>  is the "version" we refer to throughout this document.
>
>  If the output shows a release below 6.5.22, then the system may be
>  vulnerable unless patched.
>
>
> - ----------------------------
> - --- Temporary Workaround ---
> - ----------------------------
>
>  There is no effective workaround available for this vulnerability.
>
>  SGI understands that there are times when upgrading the operating system
>  or
>  installing patches are inconvenient or not possible.  In those instances,
>  we recommend to run the following as root:
>
>    # chkconfig sendmail off
>
>    # /etc/init.d/sendmail stop
>
>  Of course, you will no longer have the services of the sendmail server
>  after doing this.
>
>  SGI recommends either upgrading to IRIX 6.5.22 (when available),
>  or installing the appropriate patch from the listing below.
>
>
> - ----------------
> - --- Solution ---
> - ----------------
>
>  SGI has provided a series of patches for these vulnerabilities. Our
>  recommendation is to upgrade to IRIX 6.5.22, or install the appropriate
>  patch.
>
>  OS Version     Vulnerable?     Patch #      Other Actions
>  ----------     -----------     -------      -------------
>  IRIX 3.x        unknown                     Note 1
>  IRIX 4.x        unknown                     Note 1
>  IRIX 5.x        unknown                     Note 1
>  IRIX 6.0.x      unknown                     Note 1
>  IRIX 6.1        unknown                     Note 1
>  IRIX 6.2        unknown                     Note 1
>  IRIX 6.3        unknown                     Note 1
>  IRIX 6.4        unknown                     Note 1
>  IRIX 6.5          no                       Notes 2
>  IRIX 6.5.1        no                       Notes 2
>  IRIX 6.5.2        no                       Notes 2
>  IRIX 6.5.3        no                       Notes 2
>  IRIX 6.5.4        no                       Notes 2
>  IRIX 6.5.5        no                       Notes 2
>  IRIX 6.5.6        no                       Notes 2
>  IRIX 6.5.7        no                       Notes 2
>  IRIX 6.5.8        no                       Notes 2
>  IRIX 6.5.9        no                       Notes 2
>  IRIX 6.5.10       no                       Notes 2
>  IRIX 6.5.11       no                       Notes 2
>  IRIX 6.5.12       no                       Notes 2
>  IRIX 6.5.13       no                       Notes 2
>  IRIX 6.5.14       no                       Notes 2
>  IRIX 6.5.15       yes         5326         Notes 2 & 3
>  IRIX 6.5.16       yes         5326         Notes 2 & 3
>  IRIX 6.5.17m      yes         5326         Notes 2 & 3
>  IRIX 6.5.17f      yes         5326         Notes 2 & 3
>  IRIX 6.5.18m      yes         5326         Notes 2 & 3
>  IRIX 6.5.18f      yes         5326         Notes 2 & 3
>  IRIX 6.5.19m      yes         5325         Notes 2 & 3
>  IRIX 6.5.19f      yes         5325         Notes 2 & 3
>  IRIX 6.5.20m      yes         5325         Notes 2 & 3
>  IRIX 6.5.20f      yes         5325         Notes 2 & 3
>  IRIX 6.5.21m      yes         5325         Notes 2 & 3
>  IRIX 6.5.21f      yes         5325         Notes 2 & 3
>  IRIX 6.5.22       no
>
>     NOTES
>
>       1) This version of the IRIX operating has been retired. Upgrade to
>          an actively supported IRIX operating system.  See
>          http://support.sgi.com for more information.
>
>       2) If you have not received an IRIX 6.5.X CD for IRIX 6.5, contact
>          your SGI Support Provider or URL: http://support.sgi.com
>
>       3) Install the required patch(es) based on your operating release.
>
>               ##### Patch File Checksums ####
> Filename:                 README.patch.5325
> Algorithm #1 (sum -r):    09719 10 README.patch.5325
> Algorithm #2 (sum):       45117 10 README.patch.5325
> MD5 checksum:             A4CBCEFAF0DEAC02547FE28E3F96DE25
>
> Filename:                 patchSG0005325
> Algorithm #1 (sum -r):    43281 4 patchSG0005325
> Algorithm #2 (sum):       16979 4 patchSG0005325
> MD5 checksum:             30C299D0A4A769502B119901103DA176
>
> Filename:                 patchSG0005325.eoe_src
> Algorithm #1 (sum -r):    46646 378 patchSG0005325.eoe_src
> Algorithm #2 (sum):       2177 378 patchSG0005325.eoe_src
> MD5 checksum:             CFF0F5ABB9184F94DD7DD401D99FD480
>
> Filename:                 patchSG0005325.eoe_sw
> Algorithm #1 (sum -r):    25577 1104 patchSG0005325.eoe_sw
> Algorithm #2 (sum):       50436 1104 patchSG0005325.eoe_sw
> MD5 checksum:             74A68DFEDFFF4E69B9F604EC39E11CCA
>
> Filename:                 patchSG0005325.idb
> Algorithm #1 (sum -r):    52566 4 patchSG0005325.idb
> Algorithm #2 (sum):       23751 4 patchSG0005325.idb
> MD5 checksum:             04FC1A96D695890B218C2A775FDF0506
>
> Filename:                 README.patch.5326
> Algorithm #1 (sum -r):    26888 10 README.patch.5326
> Algorithm #2 (sum):       39764 10 README.patch.5326
> MD5 checksum:             8B05AFCB0ED432B275577D5BC4F239EF
>
> Filename:                 patchSG0005326
> Algorithm #1 (sum -r):    50468 5 patchSG0005326
> Algorithm #2 (sum):       36982 5 patchSG0005326
> MD5 checksum:             4E67239FCBA46EFE0B1DF506B4F8B472
>
> Filename:                 patchSG0005326.eoe_src
> Algorithm #1 (sum -r):    59307 302 patchSG0005326.eoe_src
> Algorithm #2 (sum):       19983 302 patchSG0005326.eoe_src
> MD5 checksum:             9FA915EE75D1309F7668FF7370DB4845
>
> Filename:                 patchSG0005326.eoe_sw
> Algorithm #1 (sum -r):    20247 664 patchSG0005326.eoe_sw
> Algorithm #2 (sum):       47682 664 patchSG0005326.eoe_sw
> MD5 checksum:             03027855CE6F3549F5051255C6A9284C
>
> Filename:                 patchSG0005326.idb
> Algorithm #1 (sum -r):    33356 4 patchSG0005326.idb
> Algorithm #2 (sum):       29499 4 patchSG0005326.idb
> MD5 checksum:             619CEC1B014DF80EEC6B4FC344941EF4
>
>
> - ------------------------
> - --- Acknowledgments ----
> - ------------------------
>
>  SGI wishes to thank sendmail.org and the users of the Internet Community
>  at large for their assistance in this matter.
>
>
> - -------------
> - --- Links ---
> - -------------
>
>  Patches are available via the web, anonymous FTP and from your SGI
>  service/support provider.
>
>  SGI Security Advisories can be found at:
>  http://www.sgi.com/support/security/ and
>
>  ftp://patches.sgi.com/support/free/security/advisories/
>
>  SGI Security Patches can be found at:
>  http://www.sgi.com/support/security/ and
>  ftp://patches.sgi.com/support/free/security/patches/
>
>  SGI patches for IRIX can be found at the following patch servers:
>  http://support.sgi.com/ and ftp://patches.sgi.com/
>
>  SGI freeware updates for IRIX can be found at:
>  http://freeware.sgi.com/
>
>  SGI fixes for SGI open sourced code can be found on:
>  http://oss.sgi.com/projects/
>
>  SGI patches and RPMs for Linux can be found at:
>  http://support.sgi.com/
>
>  SGI patches for Windows NT or 2000 can be found at:
>  http://support.sgi.com/
>
>  IRIX 5.2-6.4 Recommended/Required Patch Sets can be found at:
>  http://support.sgi.com/ and ftp://patches.sgi.com/support/patchset/
>
>  IRIX 6.5 Maintenance Release Streams can be found at:
>  http://support.sgi.com/
>
>  IRIX 6.5 Software Update CDs can be obtained from:
>  http://support.sgi.com/
>
>  The primary SGI anonymous FTP site for security advisories and patches
>  is patches.sgi.com (216.32.174.211).  Security advisories and patches
>  are located under the URL ftp://patches.sgi.com/support/free/security/
>
>  For security and patch management reasons, ftp.sgi.com (mirrors
>  patches.sgi.com security FTP repository) lags behind and does not
>  do a real-time update.
>
>
> - -----------------------------------------
> - --- SGI Security Information/Contacts ---
> - -----------------------------------------
>
>  If there are questions about this document, email can be sent to
>  security-info{at}sgi.com.
>
>                        ------oOo------
>
>  SGI provides security information and patches for use by the entire SGI
>  community.  This information is freely available to any person needing
>  the information and is available via anonymous FTP and the Web.
>
>  The primary SGI anonymous FTP site for security advisories and patches
>  is patches.sgi.com (216.32.174.211).  Security advisories and patches
>  are located under the URL ftp://patches.sgi.com/support/free/security/
>
>  The SGI Security Headquarters Web page is accessible at the URL:
>  http://www.sgi.com/support/security/
>
>  For issues with the patches on the FTP sites, email can be sent to
>  security-info{at}sgi.com.
>
>  For assistance obtaining or working with security patches, please
>  contact your SGI support provider.
>
>                        ------oOo------
>
>  SGI provides a free security mailing list service called wiretap and
>  encourages interested parties to self-subscribe to receive (via email)
>  all SGI Security Advisories when they are released. Subscribing to the
>  mailing list can be done via the Web
>  (http://www.sgi.com/support/security/wiretap.html)
>  or by sending email to SGI as outlined below.
>
>  % mail wiretap-request{at}sgi.com
>  subscribe wiretap 
>  end
>  ^d
>
>  In the example above,   wish the mailing list information sent to.  The word end must be on a
>  separate line to indicate the end of the body of the message. The
>  control-d (^d) is used to indicate to the mail program that you are
>  finished composing the mail message.
>
>                        ------oOo------
>
>  SGI provides a comprehensive customer World Wide Web site. This site is
>  located at http://www.sgi.com/support/security/ .
>
>                        ------oOo------
>
>  If there are general security questions on SGI systems, email can be
>  sent to security-info{at}sgi.com.
>
>  For reporting *NEW* SGI security issues, email can be sent to
>  security-alert{at}sgi.com or contact your SGI support provider.  A
>  support contract is not required for submitting a security report.
>
>
____________________________________________________________________________
> __
>
>        This information is provided freely to all interested parties
>        and may be redistributed provided that it is not altered in any
>        way, SGI is appropriately credited and the document retains and
>        includes its valid PGP signature.
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.2
>
> iQCVAwUBP3iRprQ4cFApAP75AQGxsgP5AaTNckpDGNT/uRhOycuD8PxVwkF8DgNu
> NPyFm5aWHoZoC6/GzMxIL+OqmOcmLoCZlhUtILhjb7uwBEJQkGfrW7H8+pf7Qblo
> B4okeg05xuqeUBoPaGju2LzNfpClLPXEP9wkoXVk8PpYaNsONGdYAR4BVE/GnQHv
> MqrWaFs+Wbg=
> =QTtm
> -----END PGP SIGNATURE-----

--
Jeff Shultz

--- BBBS/NT v4.01 Flag-5