Product
Sun Cobalt Qube 3 Server
Sun Cobalt RaQ XTR Server
Sun Cobalt RaQ 4 Server
Sun Cobalt RaQ 550 Server

Bug Id
4924783

Date of Resolved Release
12-APR-2005

Impact

A buffer overflow vulnerability in the sendmail(1M) daemon within the prescan() function may allow a local or remote unprivileged user to execute arbitrary code.

For more information on this issue, please see:

• Red Hat Advisory RHSA-2003:283-09 at: https://rhn.redhat.com/errata/RHSA-2003-283.html
• CVE CAN-2003-0681 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0681
• CVE CAN-2003-0694 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0694
• CERT:CA-2003-25 at: http://www.cert.org/advisories/CA-2003-25.html

Contributing Factors

This issue can occur in the following releases:

Sun Linux:

• Sun Linux 5.0 with sendmail versions 8.11.6-3 or earlier

Sun Cobalt:

• Qube3 with sendmail versions 8.10.2-C4stackguard or earlier
• RaQ4 with sendmail versions 8.10.2-C4stackguard or earlier
• RaQ550 with sendmail versions 8.11.6-1C6stackguard or earlier
• RaQXTR with sendmail versions 8.11.6-1C6stackguard or earlier

The sendmail(1M) package version can be determined by running the following command:

    # rpm -qa | grep -i sendmail
sendmail-8.11.6-3

Symptoms

There are no reliable symptoms that would show the described issue has been exploited.

Workaround

Until patches can be applied, sites may wish to disable sendmail(1M).

To see if sendmail is enabled:

    # /sbin/chkconfig --list sendmail
sendmail 0:off 1:off 2:off 3:on 4:on 5:on 6:off

To disable sendmail for all the run levels:

    # /sbin/chkconfig --del sendmail

Please see the man page for chkconfig(8) for more information.

Resolution

Sun Linux patches are available at:

• http://sunsolve.sun.com/patches/linux/security.html

Patches for Qube3, RaQ4, RaQ 550, RaQ XTR are available at:

• http://sunsolve.sun.com/cobalt

Modification History
Date: 30-SEP-2003

• Updated Relief/Workaround

Date: 12-APR-2005

• State: Resolved
• Updated Resolution section

Attachments

This solution has no attachment