__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
INFORMATION BULLETIN
Sendmail MTA Vulnerability
[CERTŪ Advisory CA-2003-07]
March 3, 2003 17:00 GMT Number N-048
[Revised 5 March 2003]
______________________________________________________________________________
PROBLEM: A buffer overflow vulnerability occurs in Sendmail when
processing and evaluating header fields in email collected
during an SMTP transaction.
PLATFORM: All versions of Sendmail from 5.79 to 8.12.7
DAMAGE: A remote attacker can send an email with a specially crafted
address field that triggers a buffer overflow in Sendmail
allowing root access.
SOLUTION: Upgrade to Sendmail 8.12.8 or apply the appropriate patch.
______________________________________________________________________________
VULNERABILITY The risk is HIGH. This vulnerability is especially dangerous
ASSESSMENT: because the exploit can be delivered within an email message.
The attacker doesn't need any specific knowledge of the target
to launch a successful attack. CIAC has received reports that
exploits for this vulnerability are now available.
______________________________________________________________________________
LINKS:
CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/n-048.shtml
ORIGINAL BULLETIN: http://www.cert.org/advisories/CA-2003-07.html
PATCHES: http://www.sendmail.org/8.12.8.html
Also, monitor CERT's bulletin for vendor updates and patches.
______________________________________________________________________________
[***** Start CERTŪ Advisory CA-2003-07 *****]
CERTŪ Advisory CA-2003-07 Remote Buffer
Overflow in Sendmail
Original release date: March 3, 2003
Last revised: March 4, 2003
Source: CERT/CC
A complete revision history can be found at the end of this file.
Systems Affected
Sendmail Pro (all versions)
Sendmail Switch 2.1 prior to 2.1.5
Sendmail Switch 2.2 prior to 2.2.5
Sendmail Switch 3.0 prior to 3.0.3
Sendmail for NT 2.X prior to 2.6.2
Sendmail for NT 3.0 prior to 3.0.3
Systems running open-source sendmail versions prior to 8.12.8, including UNIX and
Linux systems
Overview
There is a vulnerability in sendmail that may allow remote attackers to gain the
privileges of the sendmail daemon, typically root.
I. Description
Researchers at Internet Security Systems (ISS) have discovered a remotely
exploitable vulnerability in sendmail. This vulnerability could allow an
intruder to gain control of a vulnerable sendmail server.
Most organizations have a variety of mail transfer agents (MTAs) at various
locations within their network, with at least one exposed to the Internet.
Since sendmail is the most popular MTA, most medium-sized to large organizations
are likely to have at least one vulnerable sendmail server. In addition,
many UNIX and Linux workstations provide a sendmail implementation that is
enabled and running by default.
This vulnerability is message-oriented as opposed to connection-oriented. That
means that the vulnerability is triggered by the contents of a specially-crafted
email message rather than by lower-level network traffic. This is important
because an MTA that does not contain the vulnerability will pass the malicious
message along to other MTAs that may be protected at the network level. In
other words, vulnerable sendmail servers on the interior of a network are
still at risk, even if the site's border MTA uses software other than sendmail.
Also, messages capable of exploiting this vulnerability may pass undetected
through many common packet filters or firewalls.
Sendmail has indicated to the CERT/CC that this vulnerability has been
successfully exploited in a laboratory environment. We do not believe that
this exploit is available to the public. However, this vulnerability is likely
to draw significant attention from the intruder community, so the probability
of a public exploit is high.
A successful attack against an unpatched sendmail system will not leave any
messages in the system log. However, on a patched system, an attempt to exploit
this vulnerability will leave the following log message:
Dropped invalid comments from header address
Although this does not represent conclusive evidence of an attack, it may be
useful as an indicator.
A patched sendmail server will drop invalid headers, thus preventing downstream
servers from receiving them.
The CERT/CC is tracking this issue as VU#398025. This reference number corresponds
to CVE candidate CAN-2002-1337.
For more information, please see
http://www.sendmail.org
http://www.sendmail.org/8.12.8.html
http://www.sendmail.com/security/
http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21950
http://www.kb.cert.org/vuls/id/398025
II. Impact
Successful exploitation of this vulnerability may allow an attacker to gain
the privileges of the sendmail daemon, typically root. Even vulnerable sendmail
servers on the interior of a given network may be at risk since the vulnerability
is triggered from the contents of a malicious email message.
III. Solution
Apply a patch from Sendmail
Sendmail has produced patches for versions 8.9, 8.10, 8.11, and 8.12. However,
the vulnerability also exists in earlier versions of the code; therefore, site
administrators using an earlier version are encouraged to upgrade to 8.12.8. These
patches are located at
ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.12.security.cr.patch
ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.11.6.security.cr.patch
ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.9.3.security.cr.patch
Apply a patch from your vendor
Many vendors include vulnerable sendmail servers as part of their software
distributions. We have notified vendors of this vulnerability and recorded
their responses in the systems affected section of VU#398025. Several vendors
have provided a statement for direct inclusion in this advisory; these
statements are available in Appendix A.
Enable the RunAsUser option
There is no known workaround for this vulnerability. Until a patch can be
applied, you may wish to set the RunAsUser option to reduce the impact of
this vulnerability. As a good general practice, the CERT/CC recommends
limiting the privileges of an application or service whenever possible.
Appendix A. - Vendor Information
This appendix contains information provided by vendors for this advisory.
As vendors report new information to the CERT/CC, we will update this section
and note the changes in our revision history. If a particular vendor is not
listed below, we have not received their comments.
Apple Computer, Inc.
Security Update 2003-03-03 is available to fix this issue. Packages are
available for Mac OS X 10.1.5 and Mac OS X 10.2.4. It should be noted that
sendmail is not enabled by default on Mac OS X, so only those systems which
have explicitly enabled it are susceptible to the vulnerability. All customers
of Mac OS X, however, are encouraged to apply this update to their systems.
Avaya, Inc.
Avaya is aware of the vulnerability and is investigating impact. As new
information is available this statement will be updated.
BSD/OS
Wind River Systems has created patches for this problem which are available
from the normal locations for each release. The relevant patches are M500-006
for BSD/OS version 5.0 or the Wind River Platform for Server Appliances 1.0,
M431-002 for BSD/OS 4.3.1, or M420-032 for BSD/OS 4.2 systems.
Cisco Systems
Cisco is investigating this issue. If we determine any of our products are
vulnerable that information will be available at:
http://www.cisco.com/go/psirt
Cray Inc.
The code supplied by Cray, Inc. in Unicos, Unicos/mk, and Unicos/mp may be vulnerable.
Cray has opened SPRs 724749 and 724750 to investigate.
Cray, Inc. is not vulnerable for the MTA systems.
Debian
Updated packages for sendmail and sendmail-wide will be available at
http://www.debian.org/security/2003/dsa-257
Hewlett-Packard Company
SOURCE:
Hewlett-Packard Company
HP Services
Software Security Response Team
x-ref: SSRT3469 sendmail
HP will provide notice of the availability of patches through standard
security bulletin announcements and be available from your normal HP
Services support channel.
Hitachi, Ltd.
Hitachi's GR2000 gibabit router series
- is NOT vulnerable, because it does not support sendmail.
Hitachi's HI-UX/WE2
- contains sendmail.
We are investigating the affect of VU#398025.
We are checking in detail whether they have same kind of
vulnerablilities or not.
IBM Corporation
The AIX operating system is vulnerable to the sendmail issues discussed in
releases 4.3.3, 5.1.0 and 5.2.0.
A temporary patch is available through an efix package which can be found at
ftp://ftp.software.ibm.com/aix/efixes/security/sendmail_efix.tar.Z
IBM will provide the following official fixes:
APAR number for AIX 4.3.3: IY40500 (available approx. 03/12/2003)
APAR number for AIX 5.1.0: IY40501 (available approx. 04/28/2003)
APAR number for AIX 5.2.0: IY40502 (available approx. 04/28/2003)
Juniper Networks
Sendmail does not ship with any Juniper Networks product, so there is no
vulnerability to this issue.
Lotus
IBM has determined that Lotus products, including Notes and Domino, are not
vulnerable to the sendmail issues reported by ISS.
MandrakeSoft
MandrakeSoft has issued updated sendmail packages that are not vulnerable to
this problem by using the patches provided by the sendmail development team.
Users can use urpmi or the Software Manager to upgrade packages. The web
advisory is available:
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:028
Openwall GNU/*/Linux
Openwall GNU/*/Linux is not vulnerable. We use Postfix as the MTA, not sendmail.
Red Hat Inc.
Updated sendmail packages that are not vulnerable to this issue are available
for Red Hat Linux, Red Hat Advanced Server, and Red Hat Advanced Workstation.
Red Hat Network users can update their systems using the 'up2date' tool.
Red Hat Linux:
http://rhn.redhat.com/errata/RHSA-2003-073.html
Red Hat Linux Advanced Server, Advanced Workstation:
http://rhn.redhat.com/errata/RHSA-2003-074.html
SGI
SGI acknowledges VU#398025 reported by CERT and has released an advisory to
address the vulnerability on IRIX.
Refer to SGI Security Advisory 20030301-01-P available from
ftp://patches.sgi.com/support/free/security/advisories/20030301-01-P
or
http://www.sgi.com/support/security/.
The Sendmail Consortium
The Sendmail Consortium suggests that sites upgrade to 8.12.8 if possible.
Alternatively, patches are available for 8.9, 8.10, 8.11, and 8.12 on
http://www.sendmail.org/
Sendmail, Inc.
All commercial releases including Sendmail Switch, Sendmail Advanced Message
Server (which includes the Sendmail Switch MTA), Sendmail for NT, and
Sendmail Pro are affected by this issue. Patch information is available at
http://www.sendmail.com/security.
Sun Microsystems
Solaris 2.6, 7, 8 and 9 are vulnerable to VU#398025.
Sun will be publishing a Sun Alert for the issue at the following location shortly:
http://sunsolve.Sun.COM/pub-cgi/retrieve.pl?doc=fsalert/51181
The patches listed in the Sun Alert will be available from:
http://sunsolve.sun.com/securitypatch
Our thanks to Internet Security Systems, Inc. for discovering this problem, and
to Eric Allman, Claus Assmann, and Greg Shapiro of Sendmail for notifying us of
this problem. We thank both groups for their assistance in coordinating the
response to this problem.
Authors: Jeffrey P. Lanza and Shawn V. Hernan
This document is available from: http://www.cert.org/advisories/CA-2003-07.html
CERT/CC Contact Information
Email: cert@cert.org
Phone: +1 412-268-7090 (24-hour hotline)
Fax: +1 412-268-6989
Postal address:
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
U.S.A.
CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4)
Monday through Friday; they are on call for emergencies during other hours,
on U.S. holidays, and on weekends.
Using encryption
We strongly urge you to encrypt sensitive information sent by email. Our public
PGP key is available from
http://www.cert.org/CERT_PGP.key
If you prefer to use DES, please call the CERT hotline for more information.
Getting security information
CERT publications and other security information are available from our web site
http://www.cert.org/
To subscribe to the CERT mailing list for advisories and bulletins, send email
to majordomo@cert.org. Please include in the body of your message
subscribe cert-advisory
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and
Trademark Office.
NO WARRANTY
Any material furnished by Carnegie Mellon University and the Software Engineering
Institute is furnished on an "as is" basis. Carnegie Mellon University makes no
warranties of any kind, either expressed or implied as to any matter including, but
not limited to, warranty of fitness for a particular purpose or merchantability,
exclusivity or results obtained from use of the material. Carnegie Mellon University
does not make any warranty of any kind with respect to freedom from patent,
trademark, or copyright infringement.
Conditions for use, disclaimers, and sponsorship information
Copyright 2003 Carnegie Mellon University.
Revision History
Mar 03, 2003: Initial release
Mar 03, 2003: Added statement for Sun Microsystems
Mar 03, 2003: Fixed typo in mailto: URL
Mar 04, 2003: Added statements for Juniper Networks, MandrakeSoft, and Hitachi
Mar 04, 2003: Added statement for Debian
Mar 04, 2003: Added statement for Lotus
[***** End CERTŪ Advisory CA-2003-07 *****]
_______________________________________________________________________________
CIAC wishes to acknowledge the contributions of CERT, The Sendmail Consortium,
SendMail, Inc., and ISS for the information contained in this bulletin.
_______________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193 (7x24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
N-038: Microsoft Cumulative Patch for Internet Explorer
N-039: Microsoft Unchecked Buffer in Windows Redirector Vulnerability
N-040: Red Hat Xpdf Packages Vulnerability
N-041: Sun Linux Vulnerabilities in "unzip" and GNU "tar" Commands
N-042: Updated PHP packages available
N-043: Red Hat openldap Vulnerabilities
N-044: Red Hat Updated kernel-utils Packages Fix setuid Vulnerability
N-045: Red Hat Updated PAM packages fix bug in pam_xauth Module
N-046: Multiple Vulnerabilities in Oracle Servers
N-047: Microsoft Windows ME Help and Support Center Vulnerability
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2025 AOH
