-----BEGIN PGP SIGNED MESSAGE----- =============================================================================== Security Advisory CERT-NL =============================================================================== Author/Source : Gert Meijerink & Don Stikvoort Index: S-95-05.APPENDIX Distribution : World Page : 1 Classification: External Version: 1 Subject : /bin/mail vulnerabilities (APPENDIX) Date : 30-Jan-95 =============================================================================== Issue date: January 26, 1995 This file is a supplement to CERT-NL advisory S-95-05, "/bin/mail vulnerabilities", and will be updated as additional information becomes available. {Note by courtesy of CIAC - marked *** --CERT-NL} {Note by courtesy of DFN CERT - marked &&& --CERT-NL} ////////////////////////////// Below is information we have received from vendors who have patches available or upcoming for the vulnerabilities described in this advisory, as well as vendors who have confirmed that their products are not vulnerable. If your vendor's name is not in one of these lists, contact the vendor directly for information on whether their version of sendmail is vulnerable and, if so, the status of patches to address the vulnerabilities. NOT VULNERABLE - -------------- The following vendors have reported that their products are NOT vulnerable. Apple Computer, Inc. Berkeley SW Design, Inc. (BSDI) Data General Corp. Harris IBM NeXT, Inc. Pyramid The Santa Cruz Operation (SCO) - not vulnerable, but see note below Sun Microsystems, Inc. - Solaris 2.x (SunOS 4.x is vulnerable; see below) &&& If the patch 102042-01 for SunOS 5.4 (Solaris 2.4) for &&& &&& "backward compatibility of /bin/mail to 4.x versions" &&& &&& will make the /bin/mail program vulnerable is not clear. &&& In addition, we have reports that the following products are NOT vulnerable. FreeBSD NetBSD *** Cray Research, Inc. *** VULNERABLE - ---------- We have reports that the following vendors' products ARE vulnerable. Patch information is provided below. - ----------------------------- Digital Equipment Corporation Vulnerable: DEC OSF/1 versions 1.2, 1.3, and 2.0 DEC ULTRIX versions 4.3, 4.3A, and 4.4 Obtain and install the appropriate patch according to the instructions included with the patch. The patch that corrects the /bin/mail problem in each case is part of a comprehensive Security Enhanced Kit that addresses other problems as well. This kit has been available since May 17, 1994. It is described in CERT-NL security advisory S-94-14 of May 18, 1994. 1. DEC OSF/1 Upgrade/install OSF/1 to a minimum of V2.0 and install Security Enhanced Kit CSCPAT_4061 v1.0. 2. DEC ULTRIX Upgrade/install ULTRIX to a minimum of V4.4 and install Security Enhanced Kit CSCPAT_4060 v1.0. Both kits listed above are available from Digital Equipment Corporation by contacting your normal Digital support channel or by request via DSNlink for electronic transfer. - ----------------------------- The Santa Cruz Operation (SCO) SCO's version of /bin/mail is not vulnerable to the problems mentioned in this advisory. SCO's /bin/mail is not setuid-root. However, SCO's /bin/mail has other security-related issues that are fixed by SCO's Support Level Supplement (SLS) uod392a. To get this: ftp: ftp.sco.COM:/SLS/uod392a.Z (compressed disk image) ftp.sco.COM:/SLS/uod392a.ltr.Z (cover letter) ftp.sco.COM:/SLS/README - ----------------------------- Solbourne Grumman System Support Corporation now performs all Solbourne software and hardware support. Please contact them for further information. ftp: ftp.nts.gssc.com phone: 1-800-447-2861 e-mail: support@nts.gssc.com - ----------------------------- Sun Microsystems, Inc. Current patches are listed below, but they are being revised. SunOS Patch MD5 Checksum ------ ----- ------------ 4.1.3 100224-13.tar.Z 90a507017a1a40c4622b3f1f00ce5d2d 4.1.3UI 101436-08.tar.Z 0e64560edc61eb4b3da81a932e8b11e1 The patches can be obtained from local Sun Answer Centers or under: ftp://ftp.nic.surfnet.nl/surfnet/net-security/cert-nl/patches/sun-fixes ////////////////////////////// ============================================================================== CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet is the Dutch network for educational, research and related institutes. CERT-NL is a member of the Forum of Incident Response and Security Teams (FIRST). All CERT-NL material is available under: http://www.surfnet.nl/surfnet/security/cert-nl.html ftp://ftp.surfnet.nl/surfnet/net-security In case of computer or network security problems please contact your local CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer please address the appropriate (local) CERT/security-team). CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer, i.e. UTC+0100 in winter and UTC+0200 in summer (DST). Email: cert-nl@surfnet.nl Phone: +31 302 305 305 Fax: +31 302 305 329 Snailmail: SURFnet bv Attn. CERT-NL P.O. Box 19035 NL - 3501 DA UTRECHT The Netherlands A 7 * 24 hours phone number is available to SURFnet SSC's and FIRST members on request. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMML/KR68tkuRYDgtAQEB2QP9HHvZQG3U2vr5x75/QtS0SDgbqWAT+FRU yZ5RLU/WEWDrI7AjQ9l6V23hGkc0t7x7QSvJjoh8qnXKu5DfJVvY3X9mtLFviuyh GCCnvAowPHf4158pEx7J9n1xoEXl+ZlV36gSzSDnGeeeuuUjvZH4BhjwAxgxg4GD u+KlJhaeevI= =y1XB -----END PGP SIGNATURE-----