-----BEGIN PGP SIGNED MESSAGE-----

                 NetBSD Security Advisory 2001-017
                 =================================

Topic: sendmail(8) incorrect command line argument check leads to
                local root privilege compromise

Version: NetBSD-current: source prior to August 22, 2001
                NetBSD-1.5.1: affected
                NetBSD-1.5: affected
                NetBSD-1.4 branch: not-affected
                pkgsrc: sendmail prior to 8.11.6

Severity: Local root compromise

Fixed: NetBSD-current: August 21, 2001
                NetBSD-1.5 branch: August 22, 2001
                pkgsrc: sendmail-8.11.6

Abstract
========

The following text is from sendmail 8.11.6 release note:

SECURITY: Fix a possible memory access violation when specifying
out-of-bounds debug parameters. Problem detected by
Cade Cairns of SecurityFocus.

Technical Details
=================

Certain variables were treated as signed values, but should have been
unsigned. Bounds checking was not done when incrementing an index.

Combined with supplied command-line arguments, a local user could
exploit the setuid-root sendmail binary and the lack of bounds checking
to perform a root compromise.

Solutions and Workarounds
=========================

If your system is running a sendmail version between 8.10.0 to 8.11.5,
your system is vulnerable. Sendmail 8.11.6 is safe. Check
/usr/libexec/sendmail/sendmail.

After the upgrade of the binary file, be sure to restart any instances
of a sendmail daemon running on your system.

* All NetBSD releases using sendmail from pkgsrc between 8.10.0 and 8.11.5:

        If you are using sendmail from pkgsrc, upgrade to the
        following, or later:
                sendmail-8.11.6

* NetBSD-current:

        Systems running NetBSD-current dated from before 2001-08-21
        should be upgraded to NetBSD-current dated 2001-08-22 or later.

        The following directory needs to be updated from the
        netbsd-current CVS branch (aka HEAD):
                gnu/dist/sendmail
                gnu/usr.sbin/sendmail

        To update from CVS, re-build, and re-install sendmail:
                # cd /usr/src/gnu
                # cvs update -d -P dist/sendmail usr.sbin/sendmail
                # cd usr.sbin/sendmail
                # make cleandir all install

        Alternatively, apply the following patch (with potential offset
        differences) and rebuild & re-install sendmail:
                ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-017-sendmail.patch

        To patch, re-build and re-install sendmail
                # cd /usr/src
                # patch < /path/to/SA2001-017-sendmail.patch
                # cd gnu/usr.sbin/sendmail
                # make cleandir all install

* NetBSD 1.5, 1.5.1

        Systems running NetBSD releases on netbsd 1.5 branch (1.5 and 1.5.1)
        should be upgraded to NetBSD 1.5 branch dated 2001-08-23 or later.

        The following directories need to be updated from the
        netbsd-1-5 CVS branch:
                gnu/dist/sendmail
                gnu/usr.sbin/sendmail

        To update from CVS, re-build, and re-install sendmail:
                # cd /usr/src/gnu
                # cvs update -d -P -r netbsd-1-5 dist/sendmail usr.sbin/sendmail
                # cd usr.sbin/sendmail
                # make cleandir all install

        Alternatively, apply the following patch (with potential offset
        differences):
                ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-017-sendmail.patch

        To patch, re-build and re-install sendmail
                # cd /usr/src
                # patch < /path/to/SA2001-017-sendmail.patch
                # cd gnu/usr.sbin/sendmail
                # make cleandir all install

Thanks To
=========

Jun-ichiro itojun Hagino for patches.

Cade Cairns of SecurityFocus for discovering the issue.

Revision History
================

        2001-09-06 Initial release

More Information
================

An up-to-date PGP signed copy of this release will be maintained at
  ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2001-017.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.

Copyright 2001, The NetBSD Foundation, Inc. All Rights Reserved.

$NetBSD: NetBSD-SA2001-017.txt,v 1.8 2001/09/06 14:46:04 david Exp $

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (NetBSD)
Comment: For info see http://www.gnupg.org

iQCVAwUBO5eQbD5Ru2/4N2IFAQHh7wP6AoAVVkseqJCW0ig3n1RGOOGRHWyJ4Je/
qgRO6x0vWEJpIp32fIILQtTLAl2dimrJSi6ApBdl0/7d4EBo4l+rnELbI0sKJaj2
vcxgrhsL6rtUfhW8/qH9Gwr106sy78OMTuHrElEBrwuoy+T1XqTcXJGOwR1Rp1py
BWbKwI4jGws=
=1y/j
-----END PGP SIGNATURE-----

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]