SendMail Vulnerability

Affects all versions; patched version now available

[rogerd]

Just got an alert from SANS.org about a vulnerability in all versions of Sendmail that could allow a hacker root or superuser access when sendmail is running with those privileges.

It looks like Sendmail 8.12.8 now available at Sendmail.org corrects this.

[hakre]

thanks a lot. more details are available at iss [iss.net].

[bcc1234]

...In other news today, a new brain patch has been released for all sys admins who run sendmail. It comes in 3 different flavors, blue pill, red pill, and yellow pill - qmail, postfix, and exim respectively. Pregnant women and children under 12 should consult a doctor before taking...

[David]

brain patch

or log on and type

up2date -u
RedHat OS Required

[hakre]

yes, after the detailed description it's even possible for me to execute the update script on a redhat server ;)

[rogerd]

brain patch

Hmmm, might need some of those. It seems like most of the UNIX/LINUX hosts I deal with still run Sendmail.

[bcc1234]

Hmmm, might need some of those.

Get the blue pill, my favorite :)

[john316]

After updating sendmail, is it neccesary to restart the machine?

[jpjones]

Nope - just restart sendmail.

/etc/rc.d/init.d/sendmail restart

as root

JP

[andreasfriedrich]

Although I admit that configuring Sendmail was great fun when I had enough time on my hands Postfix is just a lot easier to run and a lot more secure ;)

Andreas

[martin]

Yah, go with the red pill.

[bcc1234]

Yah, go with the red pill.

Well, according to this
[slashdot.org...]
most of us are on pills :)