The sendmail overflow bug -- full analysis

By John McCormick, TechRepublic, 17 March, 2003 11:11

Mitigating factors As I mentioned above, there is an ongoing debate about whether this Sendmail vulnerability is a widespread threat or, because of various mitigating factors, it can be exploited on only a few systems. The Last Stage of Delirium says that its preliminary test of this exploit showed it wasn't as dangerous as first thought: "Due to the nature of the discussed Sendmail vulnerability it seems that it is unexploitable on most of commercially available Unix systems. It also doesn't seem to be exploitable on most of the default SMTP installations of x86 based open source systems. This leads to the conclusion that the overall impact of the vulnerability is rather limited and not so significant as it might be thought." However, the group's analysis covered only one possible exploit mechanism on Unix and Linux (Slackwave and Red Hat) servers. In a BugTraq message, Sendmail's Eric Allman responded to the Last Stage of Delirium's downplaying of this vulnerability by saying, "Besides direct execution path exploits, there are other variables that are not pointers that have security implications; finding one of them within range will be more difficult, but probably not impossible ... Everyone should patch as soon as possible, regardless of platform." Fix--patch or update to Sendmail version 8.12.8. Sendmail.org has produced patches for versions 8.9, 8.10, 8.11, and 8.12, but the vulnerability is also found in earlier versions. For those who are using earlier versions of the software, Sendmail.org recommends open source users of versions prior to 8.9 take the opportunity to update to the latest version. Sendmail Inc. is also making a binary patch available for commercial customers. ISS has developed a "virtual" patch for the Sendmail vulnerability using the security company's Dynamic Threat Protection platform. Updates are available from the ISS Download center. Final word ISS reports that it notified Sendmail on Jan. 13, 2003, and received confirmation from the vendor on the same day. ISS worked with the vendor and reports good cooperation. It did not make a public announcement of the threat until March 3, 2003. Still, I have to wonder why the Last Stage of Delirium hackers felt it was necessary to publish a detailed proof of concept for this Sendmail bug, which no one was denying existed. The first group to discover a vulnerability (ISS, in this instance) may have a good reason to publish proof of concept showing how to engineer an attack, especially if vendors are ignoring them. However, what legitimate purpose is served by doing so after everyone admits there is a problem and moves to fix it? The usefulness of this posting would be more obvious if the Last Stage of Delirium had completely explored the vulnerability and was demonstrating that it really wasn't very dangerous. But its BugTraq report began, "We did not perform full analysis of this issue," and ended, "However, we cannot exclude that there does not exist another execution path in the Sendmail code that could lead to the program counter overwrite." On the other hand, according to the report, the exploit doesn't really work very well. In that light, I guess there was little harm in publishing the exploit unless someone uses it to explore other ways to take advantage of the flaw.

For a weekly round-up of the enterprise IT news, sign up for the Enterpise newsletter. Tell us what you think in the Enterprise Mailroom.

« Previous
1
2
Next »

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

ZDNet UK Live

> I'm told it's somewhat annoying when people have their Macs stolen > and Apple stores treat the thief as the owner, but there you go. Ouch,...

9 minutes ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

@kevinmchapman. OK, I acknowledge that 'most' was a gratuitous throwaway comment as an afterthought and too presumptuous. As to proof, as you...

5 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint

@BrownieBoy > Works really well for thieves.... >> Nice attempt to deflect the argument by tossing in a point that's totally >> irrelevant, even...

6 hours ago by Jack Schofield on AMD Ultrathins to challenge Intel Ultrabooks

fantastic that the so called piracy bills have been withdrawn. however, these anti-democracy supporters are still in the shadows so lets be alert...

6 hours ago by raskolnikof on SOPA, Protect IP support wavers in face of online protest

Please God no; teach them anything you like - thinking rationally, the uses and misuses of data, what data is and what it's not - but leave the...

9 hours ago by Tony Douglas via Facebook on Kids are the future. Teach ’em to code.

@Jack, > Works really well for thieves.... Nice attempt to deflect the argument by tossing in a point that's totally irrelevant, even it were...

23 hours ago by BrownieBoy on AMD Ultrathins to challenge Intel Ultrabooks

Make that 13 people now - I got refused today at Manchester airport. I thought I was up to date on this legislation - I knew of the EU ruling from...

1 day ago by bootlegger on UK airport body scans will not be opt out

Don't forget to check out apps like GoodReader or SlideShark either, they're indispensible for people on the go in presentation situations. Best...

1 day ago by tinycg on Four top iPad apps for people on the move

Well it seems there is something a number of us agree on. Why is the Ubuntu Unity launcher so ugly? I thought perhaps it was something to do with...

1 day ago by TerryRK on A tale of two distros: Ubuntu and Linux Mint

Duplicate comments are not made intentionally. Its very good to know that now you are keeping check on this problem because sometimes a commenter...

2 days ago by Freebies202 on Microsoft fixes blog comments, speeds up blogs with open source

"the very significant number of users" and "many (most) of us" - you have no evidence for these statements. It is a fact that most users are saying...

2 days ago by kevinmchapman on A tale of two distros: Ubuntu and Linux Mint