Security Update for Sendmail Available

Sendmail was recently notified by security researchers at ISS that they discovered certain timing conditions that may permit a specifically crafted attack to take over the sendmail MTA process.

CGIDir
Friday, March 24, 2006; 01:34 AM

The Sendmail project has released a patch for recently discovered security hole in their product.  Systems that contain the sendmail Mail Transfer Agent are susceptible, under certain condition, to a dedicated attack that can allow execution of malicious code.  So far, Sendmail said, no publicly available exploits for this vulnerability are reported.

Within certain operating system architectures, a remote attacker may be able to force certain timing conditions that would allow execution of arbitrary code or commands on a vulnerable system. Systems running an MTA are typically deployed in the DMZ as a gateway for delivering inbound and outbound email, though they may also be used for internal email delivery between systems or applications.  In the case of a compromised system, an attack could lead to exposure, deletion, or modification of programs and data on the affected system, interference with or interception of email delivery, and potentially unauthorized access to other systems in the network.  Systems running any of the following software are considered vulnerable:

Open Source

1. Sendmail 8.13.5 and earlier versions

Sendmail Commercial Products

1. Sendmail Switch, Managed MTA, and Multi-Switch v 3.1.7 and earlier for Solaris, Linux, AIX, and HP-UX
2. Sendmail Sentrion 1.1 Appliance
3. Sendmail Advanced Message Server and Message Store v 2.2 and earlier for Solaris, Linux, AIX, and HP-UX
4. Intelligent Quarantine 3.0 for Solaris and Linux

3rd Party Products Containing the MTA

Sendmail working with CERT/CC has notified affected vendors and provided them with source code patches to sendmail MTA 8.12 and 8.13 for use in their affected products.  CERT/CC will publish specific vendor information on the availability of customer patches.

More information is available at the Sendmail website (www.sendmail.com).