114 lines
4.2 KiB
Text
114 lines
4.2 KiB
Text
|
-----BEGIN PGP SIGNED MESSAGE-----
|
||
|
|
|
||
|
|
=============================================================================
|
||
|
|
FreeBSD-SA-96:03 Security Advisory
|
||
|
|
FreeBSD, Inc.
|
||
|
|
|
||
|
|
Topic: *suggested action only* sendmail smrsh now available
|
||
|
|
|
||
|
|
Category: core
|
||
|
|
Module: sendmail
|
||
|
|
Announced: 1996-04-20
|
||
|
|
Affects: FreeBSD 2.1.0 and earlier distributions
|
||
|
|
Corrected: 1996-04-21 2.2-current and 2.1-stable sources
|
||
|
|
FreeBSD only: no
|
||
|
|
|
||
|
|
Patches: ftp://freebsd.org/pub/CERT/patches/SA-96:03/
|
||
|
|
|
||
|
|
=============================================================================
|
||
|
|
|
||
|
|
I. Background
|
||
|
|
|
||
|
|
The sendmail mail transfer agent has a rather poor reputation
|
||
|
|
for security related problems. FreeBSD ships a version of
|
||
|
|
sendmail that has all known security problems fixed, but this
|
||
|
|
doesn't mean there won't be more found in the future.
|
||
|
|
|
||
|
|
The author of sendmail recognized this posibility and has
|
||
|
|
included a new utility called "smrsh". The FreeBSD Project
|
||
|
|
would like to encourage system administrators to use this
|
||
|
|
utility as a hedge against future possible security holes.
|
||
|
|
|
||
|
|
|
||
|
|
II. Problem Description
|
||
|
|
|
||
|
|
Sendmail has the ability to deliver mail to a program on the
|
||
|
|
local system via a pipe. This feature is often used to
|
||
|
|
support automatic mail filtering and vacation programs.
|
||
|
|
|
||
|
|
This provides a very flexible way to deliver information to
|
||
|
|
an automated task running on a mailserver. Unfortunately,
|
||
|
|
this allows unprivileged users to write tasks that may not
|
||
|
|
properly check for common attacks via the program delivery
|
||
|
|
system.
|
||
|
|
|
||
|
|
The next release of FreeBSD will now install the sendmail
|
||
|
|
restricted shell utility, smrsh in /usr/libexec and create
|
||
|
|
the directory /usr/libexec/sm.bin to hold programs that
|
||
|
|
may be executed by sendmail to deliver mail to pipes.
|
||
|
|
|
||
|
|
|
||
|
|
III. Impact
|
||
|
|
|
||
|
|
There is no known security impact on FreeBSD systems at the
|
||
|
|
of this document's publication. There is no direct requirement
|
||
|
|
to install the smrsh utility.
|
||
|
|
|
||
|
|
The FreeBSD Project suggests using smrsh in conjunction with
|
||
|
|
sendmail in environments where the local system administrator
|
||
|
|
believes there is a need to protect against as-of-yet undiscovered
|
||
|
|
security holes in sendmail.
|
||
|
|
|
||
|
|
Use of this utility is /not/ enabled by default in standard
|
||
|
|
sendmail configuration files distributed by FreeBSD to retain
|
||
|
|
backwards compatibility with previous sendmail operation. Use
|
||
|
|
of this utility may break functionality that users expect.
|
||
|
|
Please read the smrsh(8) manual page and/or the README file in
|
||
|
|
/usr/src/usr.sbin/sendmail/smrsh BEFORE attempting to use smrsh.
|
||
|
|
|
||
|
|
|
||
|
|
IV. Solution(s)
|
||
|
|
|
||
|
|
This program is available in the 2.1-stable and 2.2-current
|
||
|
|
source code distributions. It is not compiled, installed,
|
||
|
|
or enabled in FreeBSD 2.1.0 by default.
|
||
|
|
|
||
|
|
The Apache Group released version 1.05 of the daemon which fixes
|
||
|
|
this vulnerability. The FreeBSD Project updated the ports and
|
||
|
|
packages system to use this new daemon.
|
||
|
|
|
||
|
|
Interested parties may obtain an updated pre-compiled FreeBSD
|
||
|
|
package from:
|
||
|
|
|
||
|
|
ftp://ftp.freebsd.org/pub/FreeBSD/packages-current/www/apache-1.0.5.tgz
|
||
|
|
|
||
|
|
and an updated "automatic port" from the directory hierarchy:
|
||
|
|
|
||
|
|
ftp://ftp.freebsd.org/pub/FreeBSD/ports-current/www/apache.tar.gz
|
||
|
|
|
||
|
|
|
||
|
|
=============================================================================
|
||
|
|
FreeBSD, Inc.
|
||
|
|
|
||
|
|
Web Site: http://www.freebsd.org/
|
||
|
|
Confidential contacts: security-officer@freebsd.org
|
||
|
|
PGP Key: ftp://freebsd.org/pub/CERT/public_key.asc
|
||
|
|
Security notifications: security-notifications@freebsd.org
|
||
|
|
Security public discussion: security@freebsd.org
|
||
|
|
|
||
|
|
Notice: Any patches in this document may not apply cleanly due to
|
||
|
|
modifications caused by digital signature or mailer software.
|
||
|
|
Please reference the URL listed at the top of this document
|
||
|
|
for original copies of all patches if necessary.
|
||
|
|
=============================================================================
|
||
|
|
|
||
|
|
-----BEGIN PGP SIGNATURE-----
|
||
|
|
Version: 2.6.2
|
||
|
|
|
||
|
|
iQCVAwUBMaLAjlUuHi5z0oilAQFXzAP/ZV0BgEsoyM2xylQgTPWWTh4pZl6kMtqn
|
||
|
|
lFaxkgkcO7d8nAVfLNcmhkIGtEU471uR1qb13MST7QQQ2oNBq63955aomMcNbphY
|
||
|
|
LqXx0IpLbYZWjR5A3bbFRmxKZGkNQOzOpZCAF1GA5+ElTw4fpJ2kWRmRiZLAdPWe
|
||
|
|
btD3OFRGXIM=
|
||
|
|
=yYqF
|
||
|
|
-----END PGP SIGNATURE-----
|