DESCRIPTION

Sendmail is a widely used Mail Transport Agent (MTA) which is included in all Red Hat Linux distributions.

During a code audit of Sendmail by ISS, a critical vulnerability was uncovered that affects unpatched versions of Sendmail prior to version 8.12.8. A remote attacker can send a carefully crafted email message which, when processed by sendmail, causes arbitrary code to be executed as root.

We are advised that a proof-of-concept exploit is known to exist, but is not believed to be in the wild.

Since this is a message-based vulnerability, MTAs other than Sendmail may pass on the carefully crafted message. This means that unpatched versions of Sendmail inside a network could still be at risk even if they do not accept external connections directly.

In addition, the restricted shell (SMRSH) in Sendmail allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after "||" sequences or "/" characters, which are not properly filtered or verified. A sucessful attack would allow an attacker who has a local account on a system which has explicitly enabled smrsh to execute arbitrary binaries as themselves by utilizing their .forward file.

Update: The URLs below were listed incorrectly in the first issue.

SOLUTION

Download the following RPM packages to the NetWinder into a temporary directory, then install them with the command "rpm -Uvh *.rpm". Be sure there are no other files ending in ".rpm" in the temporary directory. Then, restart the sendmail service with "service sendmail restart". See http://www.netwinder.org/security/install.html for more help.

Required packages for DM-3.9

ftp://ftp.netwinder.org/pub/netwinder/updates/3.9-28/armv4l/sendmail-8.12.8-1.80.armv4l.rpm
ftp://ftp.netwinder.org/pub/netwinder/updates/3.9-28/armv4l/sendmail-cf-8.12.8-1.80.armv4l.rpm

Required packages for DM-3.1 and OfficeServer

ftp://ftp.netwinder.org/pub/netwinder/updates/3.1-15/armv4l/sendmail-8.11.6-1.62.2.armv4l.rpm
ftp://ftp.netwinder.org/pub/netwinder/updates/3.1-15/armv4l/sendmail-cf-8.11.6-1.62.2.armv4l.rpm

For OfficeServer: installing this RPM will break the ability to edit email aliases via the web GUI. This is because of tighened restrictions on the "newaliases" command. Simple fix is to edit the "smtp.cgi" script: locate the call to "newaliases". A few lines above this, locate "$< = $uid" and "$> = $euid" -- delete or comment out those two lines.

REFERENCES