|
|
An input validation error in the debugging functionality of all currently
released versions of sendmail can enable a local user to gain root
access. New packages that fix this problem are available for Red Hat Linux
5.2, 6.2, 7.0, and 7.1.
|
|
---------------------------------------------------------------------
Red Hat, Inc. Red Hat Security Advisory
Synopsis: New sendmail packages available which fix a local root exploit
Advisory ID: RHSA-2001:106-08
Issue date: 2001-08-28
Updated on: 2001-10-22
Product: Red Hat Linux
Keywords: sendmail local root input validation debug smtp mta
Cross references:
Obsoletes:
---------------------------------------------------------------------
1. Topic:
An input validation error in the debugging functionality of all currently
released versions of sendmail can enable a local user to gain root
access. New packages that fix this problem are available for Red Hat Linux
5.2, 6.2, 7.0, and 7.1.
2. Relevant releases/architectures:
Red Hat Linux 5.2 - alpha, i386, sparc
Red Hat Linux 6.2 - alpha, i386, sparc
Red Hat Linux 7.0 - alpha, i386
Red Hat Linux 7.1 - alpha, i386, ia64
3. Problem description:
Sendmail, the low-level system for sending and receiving email for Red
Hat Linux, has an input validation flaw in part of its debugging code.
This flaw could be exploited by an attacker who already has local access
to a system and wants to gain root privileges.
Red Hat is issuing new sendmail packages that correct this flaw for all our
currently supported Red Hat Linux platforms. All users are strongly
advised to apply these fixes.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.
Please note that this update is also available via Red Hat Network. Many
people find this to be an easier way to apply updates. To use Red Hat
Network, launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
52194 - SUID sendmail allows local overflow
6. RPMs required:
Red Hat Linux 5.2:
SRPMS:
ftp://updates.redhat.com/5.2/en/os/SRPMS/sendmail-8.11.6-1.5.y.src.rpm
alpha:
ftp://updates.redhat.com/5.2/en/os/alpha/sendmail-8.11.6-1.5.y.alpha.rpm
ftp://updates.redhat.com/5.2/en/os/alpha/sendmail-cf-8.11.6-1.5.y.alpha.rpm
ftp://updates.redhat.com/5.2/en/os/alpha/sendmail-doc-8.11.6-1.5.y.alpha.rpm
i386:
ftp://updates.redhat.com/5.2/en/os/i386/sendmail-8.11.6-1.5.y.i386.rpm
ftp://updates.redhat.com/5.2/en/os/i386/sendmail-cf-8.11.6-1.5.y.i386.rpm
ftp://updates.redhat.com/5.2/en/os/i386/sendmail-doc-8.11.6-1.5.y.i386.rpm
sparc:
ftp://updates.redhat.com/5.2/en/os/sparc/sendmail-8.11.6-1.5.y.sparc.rpm
ftp://updates.redhat.com/5.2/en/os/sparc/sendmail-cf-8.11.6-1.5.y.sparc.rpm
ftp://updates.redhat.com/5.2/en/os/sparc/sendmail-doc-8.11.6-1.5.y.sparc.rpm
Red Hat Linux 6.2:
SRPMS:
ftp://updates.redhat.com/6.2/en/os/SRPMS/sendmail-8.11.6-1.6.y.src.rpm
alpha:
ftp://updates.redhat.com/6.2/en/os/alpha/sendmail-8.11.6-1.6.y.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/sendmail-cf-8.11.6-1.6.y.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/sendmail-doc-8.11.6-1.6.y.alpha.rpm
i386:
ftp://updates.redhat.com/6.2/en/os/i386/sendmail-8.11.6-1.6.y.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/sendmail-cf-8.11.6-1.6.y.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/sendmail-doc-8.11.6-1.6.y.i386.rpm
sparc:
ftp://updates.redhat.com/6.2/en/os/sparc/sendmail-8.11.6-1.6.y.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/sendmail-cf-8.11.6-1.6.y.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/sendmail-doc-8.11.6-1.6.y.sparc.rpm
Red Hat Linux 7.0:
SRPMS:
ftp://updates.redhat.com/7.0/en/os/SRPMS/sendmail-8.11.6-2.7.0.src.rpm
alpha:
ftp://updates.redhat.com/7.0/en/os/alpha/sendmail-8.11.6-2.7.0.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/sendmail-cf-8.11.6-2.7.0.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/sendmail-doc-8.11.6-2.7.0.alpha.rpm
i386:
ftp://updates.redhat.com/7.0/en/os/i386/sendmail-8.11.6-2.7.0.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/sendmail-cf-8.11.6-2.7.0.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/sendmail-doc-8.11.6-2.7.0.i386.rpm
Red Hat Linux 7.1:
SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/sendmail-8.11.6-2.7.1.src.rpm
alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/sendmail-8.11.6-2.7.1.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/sendmail-cf-8.11.6-2.7.1.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/sendmail-doc-8.11.6-2.7.1.alpha.rpm
i386:
ftp://updates.redhat.com/7.1/en/os/i386/sendmail-8.11.6-2.7.1.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/sendmail-cf-8.11.6-2.7.1.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/sendmail-doc-8.11.6-2.7.1.i386.rpm
ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/sendmail-8.11.6-2.7.1.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/sendmail-cf-8.11.6-2.7.1.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/sendmail-doc-8.11.6-2.7.1.ia64.rpm
7. Verification:
MD5 sum Package Name
--------------------------------------------------------------------------
e9d25ec525f0ed1526b8b3583d9ca7e7 5.2/en/os/SRPMS/sendmail-8.11.6-1.5.y.src.rpm
7e2dc054ad74b6ac44f6290eba54e648 5.2/en/os/alpha/sendmail-8.11.6-1.5.y.alpha.rpm
6bbd2a55046f8db9d4ee12092bca7608 5.2/en/os/alpha/sendmail-cf-8.11.6-1.5.y.alpha.rpm
552d435800d65055e1b8ae93b98d7d8e 5.2/en/os/alpha/sendmail-doc-8.11.6-1.5.y.alpha.rpm
d8d15a539b871303061fb627d8b15eb3 5.2/en/os/i386/sendmail-8.11.6-1.5.y.i386.rpm
2fae721d5336984dbea8b6324b632c88 5.2/en/os/i386/sendmail-cf-8.11.6-1.5.y.i386.rpm
19fe26557d2e2707a4bde205e43c4f77 5.2/en/os/i386/sendmail-doc-8.11.6-1.5.y.i386.rpm
335d9ea884349e8e9a7e0d5fa43a0b0b 5.2/en/os/sparc/sendmail-8.11.6-1.5.y.sparc.rpm
6a64612a560ef425801aa118f6874fc3 5.2/en/os/sparc/sendmail-cf-8.11.6-1.5.y.sparc.rpm
3e7ae72eae38c1a88b9a0c88c1f62185 5.2/en/os/sparc/sendmail-doc-8.11.6-1.5.y.sparc.rpm
9430ad1f58b31fedbd2c3118e38c91bb 6.2/en/os/SRPMS/sendmail-8.11.6-1.6.y.src.rpm
8fe26b4facd48fb59d431952cb16660f 6.2/en/os/alpha/sendmail-8.11.6-1.6.y.alpha.rpm
5a3c1b19e26925cf8d8f31cf70678f3a 6.2/en/os/alpha/sendmail-cf-8.11.6-1.6.y.alpha.rpm
fc2b2f2087c9e0a22c7e2b92dc05eaba 6.2/en/os/alpha/sendmail-doc-8.11.6-1.6.y.alpha.rpm
f677c0bc542495680a47c6b3185d3f44 6.2/en/os/i386/sendmail-8.11.6-1.6.y.i386.rpm
afc7efca38e40f1affbdc9fdce90a433 6.2/en/os/i386/sendmail-cf-8.11.6-1.6.y.i386.rpm
dfe5b8d85adba6f17da61a1d25f64f42 6.2/en/os/i386/sendmail-doc-8.11.6-1.6.y.i386.rpm
157b06887265d528675c1c68721cdbf6 6.2/en/os/sparc/sendmail-8.11.6-1.6.y.sparc.rpm
38602d5d6296b7b9ca578d4c8f446168 6.2/en/os/sparc/sendmail-cf-8.11.6-1.6.y.sparc.rpm
941a815f6b4a309f20b37e1a36e4e40f 6.2/en/os/sparc/sendmail-doc-8.11.6-1.6.y.sparc.rpm
c1fd7503743391edc745bad7da351f09 7.0/en/os/SRPMS/sendmail-8.11.6-2.7.0.src.rpm
cf7a3902265300daadb306e4e42e7ea8 7.0/en/os/alpha/sendmail-8.11.6-2.7.0.alpha.rpm
9052d47e15e6d1686289a95654498c3f 7.0/en/os/alpha/sendmail-cf-8.11.6-2.7.0.alpha.rpm
6e846271f7d0ac2094ebc0d22121fd4a 7.0/en/os/alpha/sendmail-doc-8.11.6-2.7.0.alpha.rpm
cad605de705ac26fb846253a98927536 7.0/en/os/i386/sendmail-8.11.6-2.7.0.i386.rpm
d0ad6e46ac60cd445810378933a5afbe 7.0/en/os/i386/sendmail-cf-8.11.6-2.7.0.i386.rpm
1b6ef91eafdf85c711e7da792b3294d7 7.0/en/os/i386/sendmail-doc-8.11.6-2.7.0.i386.rpm
f8ba51c13b3845a234ab077417e23122 7.1/en/os/SRPMS/sendmail-8.11.6-2.7.1.src.rpm
14111e7dc86569b0490a2b7e11288993 7.1/en/os/alpha/sendmail-8.11.6-2.7.1.alpha.rpm
8a15cd0349711ffadc8f4a0041cf6b30 7.1/en/os/alpha/sendmail-cf-8.11.6-2.7.1.alpha.rpm
d73f611abcb237f1a0e25f56ecdaa714 7.1/en/os/alpha/sendmail-doc-8.11.6-2.7.1.alpha.rpm
331c95ac2c260436643839b3ac47c71f 7.1/en/os/i386/sendmail-8.11.6-2.7.1.i386.rpm
360c54c392c09065479e45dd66f84f65 7.1/en/os/i386/sendmail-cf-8.11.6-2.7.1.i386.rpm
010e026659d20fa7fdc855b7e090f042 7.1/en/os/i386/sendmail-doc-8.11.6-2.7.1.i386.rpm
d9b97da0204c5340f64f3100782900cd 7.1/en/os/ia64/sendmail-8.11.6-2.7.1.ia64.rpm
55742cdca260b38d9654cc3db33dc41b 7.1/en/os/ia64/sendmail-cf-8.11.6-2.7.1.ia64.rpm
5395f4ee43d5e45535f96b2416ef5b5b 7.1/en/os/ia64/sendmail-doc-8.11.6-2.7.1.ia64.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key
is available at:
http://www.redhat.com/about/contact/pgpkey.html
You can verify each package with the following command:
rpm --checksig
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg
8. References:
Bugtraq ID 3163. See http://www.securityfocus.com/bid/3163 for more
information.
Problem discovered by Cade Cairns .
Copyright(c) 2000, 2001 Red Hat, Inc.
|
