Sun Linux and Cobalt Legacy Products are Vulnerable to a sendmail(1M) Buffer Overflow

Category
Security

Release Phase
Resolved

Bug Id
4826559, 16402

Date of Workaround Release
06-MAR-2003

Date of Resolved Release
02-JUN-2003

Impact

A local or remote unprivileged user may be able to gain unauthorized root access or cause a Denial of Service (DoS) due to a buffer overflow in the sendmail(1M) daemon.

This is described in ISS Security Bulletin 21950 available from http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21950.

This issue is also described in CERT Vulnerability VU#398025 (see http://www.kb.cert.org/vuls/id/398025) which is referenced in CERT Advisory CA-2003-07 (see http://www.cert.org/advisories/CA-2003-07.html).

Sun acknowledges with thanks, Internet Security Systems (ISS), (http://www.iss.net) for bringing this issue to our attention.

Please note that:

The Sun Cobalt RaQ 550 is not vulnerable to the buffer overflow, but is vulnerable to a denial of service originating from the same issue.
The Qube 3 which has the Security Hardening Patch, is not vulnerable to the buffer overflow, but is vulnerable to the denial of service. This originates from the fact that sendmail can still be crashed, even though it can not be exploited for root compromise.

For more information see:

http://www.cert.org/advisories/CA-2003-07.html
http://marc.theaimsgroup.com/?l=bugtraq&m=103350914307274
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1337

Contributing Factors

This issue can occur in the following releases:

Linux

Sun Linux 5.0 (LX50) with sendmail-8.11.6-3

Note: Sun Linux 5.0 is currently shipped with the Sun LX50 Server.

Cobalt

Sun Cobalt RaQ 3 (3000R) with sendmail-8.9.3-C6
Sun Cobalt RaQ 4 (3001R) with sendmail-8.10.2-C1
Sun Cobalt RaQ XTR (3500R) with sendmail-8.10.2-C1
Sun Cobalt Qube 3 (4000WG) with sendmail-8.10.2-C1
Sun Cobalt RaQ 550 (4100R) with sendmail-8.11.6-1C3stackguard

Note: By default, all systems are potentially vulnerable to this issue. Systems are vulnerable if they have a sendmail daemon running. This can be confirmed by the following command:

 $ /bin/ps xa | grep sendmail
 2223 ? S 0:00 sendmail: accepting connections

Symptoms

There are no reliable symptoms that would show the described issue has been exploited to gain unauthorized root access to a system.

There are no reliable symptoms that would show the described issue has been exploited to gain unauthorized root access to a host. The denial of service symptom would show that sendmail is no longer running.

If the sendmail(1M) daemon is no longer running the system may have encountered the described issue. The following command can be executed to check if the sendmail(1M) daemon is running on the system:

 $ /bin/ps xa | grep sendmail
 2223 ? S 0:00 sendmail: accepting connections

Workaround

Until patches can be applied, sites may wish to block access to the affected service from untrusted networks such as the Internet or disable the daemon where possible. Use a firewall or other packet-filtering technology to block the appropriate network ports. Consult your vendor or your firewall documentation for detailed instructions on how to configure the ports. To disable sendmail(1M) the following commands can be executed as root:

 # /etc/init.d/sendmail stop

Note: This will prevent e-mail messages from being able to be received on the system until sendmail(1M) is started again with the command:

 # /etc/init.d/sendmail start

Resolution

This issue is addressed in the following releases:

Linux

Instructions for downloading the Linux packages can be found in 1234813.1 in MyOracleSupport.

Cobalt

Instructions for downloading the Cobalt packages can also be found in 1234813.1 in MyOracleSupport.

Modification History

Date: 07-MAR-2003

Updated Contributing Factors and Relief/Workaround sections

Date: 02-JUN-2003

Updated Relief/Workaround and Resolution sections

Product
Sun Linux 5.0
olaf.reineke@sun.com
Buffer Overflow

Attachments

This solution has no attachment