Buffer Overflow in Sendmail

ChiefArcher writes "On the footsteps of openssh, Sendmail 8.12.10 has just been released due to a buffer overflow in address parsing. Sendmail states this is potentially remotely exploitable. No updates on the Sendmail site yet, but the FTP site has the release notes."

Comments

Use qmail

[DigitalNinja7]

That's why you should be using qmail, ya' code monkeys! Seems like this happens every couple months.

Re:Use qmail

[Dysan2k]

Bah! And I'll say it again, Bah!

Use Postfix! Ok, use either really, just stop using Sendmail. I run Qmail at work (due to legacy and converting Qmail's Maildir to Cyrus' Maildir just seems neigh impossible) and Postfix at home. Postfix is really straight-foward on setup and has TONS of documentation in the conf files.

Qmail, on the other hand has tons of docs on the site and lists a number of different ways to perform various tasks.

It's really a crap-shoot as to which you prefer. Just STOP USING SENDMAIL!

Re:Use qmail

[bongoras]

PLEASE PLEASE PLEASE read the fucking article...

from the release notes:

"Fix a potential buffer overflow in ruleset parsing. This problem
is not exploitable in the default sendmail configuration;
only if non-standard rulesets recipient (2), final (4), or
mailer-specific envelope recipients rulesets are used then
a problem may occur. "

http://www.sendmail.org/8.12.10.html

While I agree it's necessary to patch systems, this is hardly like the Blaster worm. I'm going to go way out on a limb here and say that 99.99% of all sendmail installations in the world don't use these rulesets. And anyone who IS using them is likely to be a sendmail weenie anyhow and they'll just take a break from writing their AI Chess program in sendmail.cf and patch it themselves.

Re:Use qmail

[Anonymous Coward]

bernstein managed to suck out the brain of many people?

Re:Use qmail

[ChaosDiscord]

That's why you should be using qmail, ya' code monkeys!

Great idea! I'll just download a package from my favorite distribution that's tuned qmail to mesh nicely with how my system is configured.

Hmm, they don't supply packages for qmail. Why not? They're not allowed to. If I take the time to make up such a package, I'm not allowed to give it to my friend.

Quoth Bernstein:

But that's a decision for the Apache maintainers, not the UNIX integrators!

Darn those pesky integrators, attempting to make their system internally consistent and trying to please their users!

I've heard great things about qmail, it's great that is available with source for no cost. But it's proprietary software, putting me at the mercy of Bernstein. If you want someone else to maintain a fork with features you desire, you're out of luck. It's fine if you're willing to accept that, but it's not acceptable to everyone. Fortunately there are other options available.

Re:Use qmail

[Pointer80]

I used perl with Mail::IMAPClient to convert from Maildir (Sendmail/Procmail w/modified qmail-pop3d) to Cyrus.

Here is the most relevant part of the perl module I wrote to handle the migration.

Please not that there are several system dependent settings in this function. Our spool was hashed to depth two. I will probably end up rewriting this module to proxy for the user, authenticating as cyrus, which would be much cleaner.

We've been using Postfix/Cyrus in production for a while now and we're really happy with it.

/pointer

"Email Different"

[Anonymous Coward]

That's why you should entrust all your email services to Hotmail.

Re:"Email Different"

[CausticWindow]

You've got a point there.

While not as flexible as mutt on a *nix server, at least Hotmail is basicly secure.

Re:"Email Different"

[buffer-overflowed]

No, you should entrust all your email to me... I'm a nice guy really. I'm *never* responsible for remotely exploitable holes.

Re:"Email Different"

[blchrist]

not all that secure http://www.securitytracker.com/alerts/2003/May/100 6728.html http://www.wired.com/news/business/0,1367,21490,00 .html

Re:"Email Different"

[rworne]

Actually it is secure, depending on your needs.

I need a mail server for non-sensitive e-mails. If someone roots Hotmail's server, I couldn't care less about it. If someone roots my server, then it's a whole different matter. I also use it to prevent handing out my real email address to the myriad of sites that require e-mail registration and for usenet postings.

So yes, in my case Hotmail is a very secure solution.

Re:"Email Different"

[Stevedust]

For disposable email accounts (for site registrations etc), take a look at Mailinator. It offers automatically generated mailboxen, which are deleted after a few hours.

It's on the site now

[Phaid]

The official announcement is here.

I've already downloaded and installed it. Thank goodness for Slackbuild scripts :)

Re:It's on the site now

[buffer-overflowed]

Lies, all lies, I'm not in sendmail, I don't even run sendmail. I run qmail.

*cough*

[interiot]

Everyone who complained that Microsoft is so evil for the lack in quality of code they put out, raise your hand so we can heckle you.

Mistakes happen to everyone, and microsoft code isn't necessarily even the most important part of the internet.

Re:*cough*

[adamruck]

*raises hand*

The difference is that Microsofts patches take forever to come out and introduce more holes than anything else.

In linux patches come out the same day... and are well documented.

Re:*cough*

[bluGill]

Sendmail has never had a good reputation for code quality. MS doesn't either. Whats your point?

Re:*cough*

[Anonymous Coward]

The difference is that not only is the news of the bug breaking now, nor that it's exploitable, but that IT'S ALREADY FIXED

Re:*cough*

[mentin]

The question is whether postfix is any better, or simply nobody looked at it yet?

Maybe the reason MS and sendmail products are so often compromized is that they are both very popular and thus are a good target for security companies? You would not get a big fame (did I say money?) for finding bugs in some obscure product. However finding bug in any Microsoft product or sendmail will bring you to headlines immediately.

Re:*cough*

[koreth]

The difference is that Microsofts patches take forever to come out and introduce more holes than anything else.

Really? What holes were introduced by, say, the Blaster worm patch? Or any other patches you care to name?

Can't argue about the speed of patches, exactly, but I'd point out that MS almost always releases a patch before the bug in question is widely exploited -- the problem with the last few worms/viruses was more with unpatched systems than lack of responsiveness on MS's part. MS could come out with a patch within a nanosecond of an exploit's discovery and there would still be millions of people who wouldn't bother applying it. That's hardly a problem that's unique to Windows -- I bet you can still find lots of Apache installations out there with known security holes.

Re:*cough*

[Aadain2001]

That's the beauty of the Linux model. At its heart is a network OS and always has been. What the users don't know won't hurt them. Let the tech savvy admins push the updates out to the servers and the desktop computers. Unlike Windows, a Linux computer only needs to be rebooted if the kernel gets updated, so there will be no real preceived downtime for the users. I use Redhat's up2date service for the computers I have a home, it I can push updates out to them through a nice web interface from anywhere in the world. And the corporate version is supposed to be even better about handling large numbers of computers. The same day that the SSH patch came out, I had it waiting to be pushed out to my computers, all with a single click. This is something Windows really lacks, and they have admitted this on many occations.

Re:*cough*

[lubricated]

The original blaster patch "fixed" windows from blaster, but now ms released ms-03-039 because the original balaster patch introduced a new vulnerability. It went from being a buffer over run to a NULL variable. Still exploitable.

Re:Sendmail, huh?

[Anonymous Coward]

Christ, the mods must really have a hard-on for sendmail. Every post critical of it in this thread was instantly downmodded, regardless of the fact that they were TRUE. Sendmail DOES have a long history of serious security flaws, and both Postfix and Qmail (I prefer Qmail) are valid responses to this trend, as neither one of them have exhibited the same problems.

Sendmail's future

[nepheles]

Is it perhaps time for a code rewrite in Sendmail, or maybe a quiet, dignified retirement? It appears, from empirical evidence, that Sendmail is insecure by design. And that's not a good idea for a mail server, in today's world of spam

Re:Sendmail's future

[bourne]

Is it perhaps time for a code rewrite in Sendmail...

IIRC 8.9 was the code rewrite.

maybe a quiet, dignified retirement?

At this point, I'd settle for a noisy drag-it-out-back-and-shoot-it.

Secure alternatives exist - Postfix, qmail. Other alternatives with better security track records and lower target profiles exist - Exim, Courier.

Time and past time to move. How many holes is it going to take?

Re:Sendmail's future

[blate]

I'm not sure that "insecure by design" is quite fair to the hard-working folks who developed this near-ubiquitous MTA.

A fairer assessment is that, when sendmail was designed, security was not as big an issue as it has become today. And in their defense, they do seem quite good about notifying people when vunerabilities arise and releasing fixes as quickly as possible.

That being said, sendmail is a pain in the ass. You have to remember that when sendmail was developed, there were many different mail protocols (besides SMTP), and sendmail had to support all of them -- this is why sendmail config files are so darned complex and unreadable. The vast majority of those have faded into obscurity, so subsequent products, like Postfix, can be much simpler and less complex and, thus, more likely to be secure. For a long time, sendmail was the only choice for a real MTA, but I think Postfix has proven itself a worthy successor.

Re:Sendmail's future

[Fizzlewhiff]

I agree and am migrating to Exchange as I type this. Hopefully it, and Outlook will be more secure for my users.

Re:Sendmail's future

[Ninja Programmer]

Is it perhaps time for a code rewrite in Sendmail, or maybe a quiet, dignified retirement?

As with most legacy software, there is a large investment in the expertise people have built up in learning how to use/configure it. So retirement won't get rid of it. Rewriting it may just lead to creation of new security flaws (for example, openssh, is a far more modern code which is far more motivated to be secure from the get go, but as recent advisories/exploits have shown that doesn't make it magically bug-free) rather than moving towards the goal of eliminating them.

The right answer is to embark on a methodology for trying to root out the bugs, and/or use technologies that are intrinsically more resilient in the first place. While a rewrite in Java or Python are problematic ideas from the very get go (either requiring an installed and functional JVM, or being as slow as a post), one can at least address the ANSI C string library weakness (the obvious lowest hanging fruit) by using a substitute.

Look guys -- this is an opportunity. Microsoft thumbs their collective noses at Open Source people because they believe that they are more innovative. If the Linux community is able to put forth mechanisms, ideas, and possibly tools that truly address the "safe programming" issue, then this would be a quick slap in their face.

Steve Ballmer has started pounding his fist and making prognostications about how Microsoft is going to deal with security via their innovation. Of course its nonsense -- but people will only realize this *if* the Open Source community is able to step up to the plate and *demonstrate* their superior solution.

Re:Sendmail's future

[RevMike]

A fairer assessment is that, when sendmail was designed, security was not as big an issue as it has become today.

Absolutely. In sendmail's heyday, the internet was a collection of several hundred .edu and .mil organizations, with a few .com technology companies thrown in, notably IBM and DEC. The few hundred thousand people on the net tended to be researchers and faculty in technical fields and their students. Security was very lax because it was a relatively small, closed, professional society. People simply didn't worry about security.

It is probably time to either move to a new MTA or rewrite sendmail form the ground up.

Re:Sendmail's future

[Nevyn]

I'm not sure that "insecure by design" is quite fair to the hard-working folks who developed this near-ubiquitous MTA.

So are you saying it is designed with security in mind?

A fairer assessment is that, when sendmail was designed, security was not as big an issue as it has become today.

So you saying (agreeing) it is designed without security in mind.

It's been years since the internet operated where everyone allowed relaying to help everyone else out. And go look at the code, they still use NIL terminated char *'s all over the place. Mostly with limited length APIs like strlcpy(), but even a few strcpy()s.

Now go look at postfix or qmail, but have fully dynamic string APIs and use them everywhere. And supprise supprise neither has had a buffer overflow.

Yay!

[Greyfox]

I'll have to dust off my sendmail sploit-of-the-week card and get them to punch it for me! 12 punches and you get a free MTA!

Re:Yay!

[JFMulder]

You should have the Windows one, you'd get even more free stuff.

Lazy Story Submitter

[Peridriga]

Just point to the ftp site?
Aight... I'll fill in the blanks

ftp://ftp.sendmail.org/pub/sendmail/RELEASE_NOTE S

8.12.10/8.12.10 2003/09/24
SECURITY: Fix a buffer overflow in address parsing. Problem
detected by Michal Zalewski, patch from Todd C. Miller
of Courtesan Consulting.
Fix a potential buffer overflow in ruleset parsing. This problem
is not exploitable in the default sendmail configuration;
only if non-standard rulesets recipient (2), final (4), or
mailer-specific envelope recipients rulesets are used then
a problem may occur. Problem noted by Timo Sirainen.
Accept 0 (and 0/0) as valid input for set MaxMimeHeaderLength.
Problem noted by Thomas Schulz.
Add several checks to avoid (theoretical) buffer over/underflows.
Properly count message size when performing 7->8 or 8->7 bit MIME
conversions. Problem noted by Werner Wiethege.
Properly compute message priority based on size of entire message,
not just header. Problem noted by Axel Holscher.
Reset SevenBitInput to its configured value between SMTP
transactions for broken clients which do not properly
announce 8 bit data. Problem noted by Stefan Roehrich.
Set {addr_type} during queue runs when processing recipients.
Based on patch from Arne Jansen.
Better error handling in case of (very unlikely) queue-id conflicts.
Perform better error recovery for address parsing, e.g., when
encountering a comment that is too long. Problem noted by
Tanel Kokk, Union Bank of Estonia.
Add ':' to the allowed character list for bogus HELO/EHLO
checking. It is used for IPv6 domain literals. Patch from
Iwaizako Takahiro of FreeBit Co., Ltd.
Reset SASL connection context after a failed authentication attempt.
Based on patch from Rob Siemborski of CMU.
Check Berkeley DB compile time version against run time version
to make sure they match.
Do not attempt AAAA (IPv6) DNS lookups if IPv6 is not enabled
in the kernel.
When a milter adds recipients and one of them causes an error,
do not ignore the other recipients. Problem noted by
Bart Duchesne.
CONFIG: Use specified SMTP error code in mailertable entries which
lack a DSN, i.e., "error:### Text". Problem noted by
Craig Hunt.
CONFIG: Call Local_trust_auth with the correct argument. Patch
from Jerome Borsboom.
CONTRIB: Better handling of temporary filenames for doublebounce.pl
and expn.pl to avoid file overwrites, etc. Patches from
Richard A. Nelson of Debian and Paul Szabo.
MAIL.LOCAL: Fix obscure race condition that could lead to an
improper mailbox truncation if close() fails after the
mailbox is fsync()'ed and a new message is delivered
after the close() and before the truncate().
MAIL.LOCAL: If mail delivery fails, do not leave behind a
stale lockfile (which is ignored after the lock timeout).
Patch from Oleg Bulyzhin of Cronyx Plus LLC.
Portability:
Port for AIX 5.2. Thanks to Steve Hubert of University
of Washington for providing access to a computer
with AIX 5.2.
setreuid(2) works on OpenBSD 3.3. Patch from
Todd C. Miller of Courtesan Consulting.
Allow for custom definition of SMRSH_CMDDIR and SMRSH_PATH
on all operating systems. Patch from Robert Harker
of Harker Systems.
Use strerror(3) on Linux. If this causes a problem on
your Linux distribution, compile with
-DHASSTRERROR=0 and tell sendmail.org about it.
Added Files:
devtools/OS/AIX.5.2

Fix this at the language level?

[ajiva]

You'd think that it would be easy to fix this at the language level. It can't be that hard to create a string library that automatically ignores everything past the end of the string.

Re:Fix this at the language level?

[interiot]

Yes, in order to make sendmail even more convoluted, I recommend it be rewritten in perl. Or maybe javascript, that would work too.

Re:Fix this at the language level?

[spektr]

I vote to have it written in Brainfuck (http://www.muppetlabs.com/~breadbox/bf). A simpler language makes a program easier to read, right?

I wouldn't be surprised entirely if it turned out that sendmail was the first (and only) non-trivial program that could be expressed in brainfuck. I fact, I believe that sendmail.cf had been ported to brainfuck already.

Nice week for open source

[gmuslera]

Yesterday was the day of openssh, and today for sendmail (whats next? bind? apache?). More than the usual rant about using alternatives like postfix/qmail/exim/etc instead of sendmail, I see that as a positive thing, could be a signal that more testing, auditing, and usage is being done, and by the open source nature of those tools, that this kind of things will be fixed or the programs will evolve to avoid this kind of things with (really) safer practices.

How does an overflow work?

[jumpingfred]

Does anyone have a good explanation of how a buffer overflow allows you to execute arbitrary code? It seems to me that the memory that gets overwritten is some what random. It is either the stack or some memory in dynamic store. It seems like each time you sent in the overflow data it will be writing a different area of memory so you don't know if you code will get executed or not. Since you have to start executing at the right place you would almost never be able to execute your code.

Re:How does an overflow work?

[Second_Derivative]

Stack grows downward, buffers on stack grow upward. Overflow a buffer and sooner or later you run into a return pointer on the buffer. Now, if you overflow it in such a way that the function corresponding to that stackgrame doesn't cause a segfault before it returns, the CPU will read in a return address you supplied, which could point to the buffer. CPU then executes the code you put in the buffer. I believe it's traditional to execve /bin/sh at this point.

Google for "Smashing the stack for fun and profit". I don't know too much of the specifics -- I'm not a script kiddie.

Re:How does an overflow work?

[Waffle Iron]

During C procedure calls, the return addresses are placed on the stack in predictable locations. Often, people use fixed-size buffers allocated on the stack in their procedures. For example:

void foo() {
char buf[100];
gets(buf);
--- do stuff ---
}

By feeding in a string longer than 100 characters, you go up the stack and can overwrite the return address to the call to 'foo'. You might replace the address with a pointer to code you've embedded in the oversized string. When the call returns, it jumps into your code rather than the calling procedure.

Re:How does an overflow work?

[barfy]

because of the addressing scheme used in Intel processors, and the standard ways of creating buffers in C and how they get executed.

When you create a buffer it tends to use *short* addressing, which means the buffer location is NEAR the code that is being executed. Generally something like,

Store a char
Increment buffer pointer by one,
am I done?
No repeat

The problem is that if the buffer "overflows" it wraps the addressing to back over the instructions being executed.

And it turns out that this behavior is not random, and you can depend on precisely what character will overwrite the code that is being executed and you write a jump statement to replace the store a char instruction into the buffer and your code starts executing... Voila, a buffer overflow exploit.

It *WAS* standard coding practice in the good old days to place the burden of correctly sized and or terminated inputs onto the code that was creating the string to be inputed. This prevented the need for excessive cycles being wasted making sure that there wasn't bad input going into the buffer. And in the good old days this was the correct thing to do. Which is why all the code was written this way, it was *good* design.

Today it turns out, that the risk of *malware*, code designed to take advantage of this behavior, for nefarious use is greater than the waste of cycles to detect bad code (which is a lot of cycles wasted). So the code needs to be rewritten to check for malware. This is the NEW good design, but it requires a massive effort to change old practices to new practices. Stuffing inputs into buffers is probably one of the most common of all operations done on computers. And changing all this code, and preventing new code written in the old way (because the code will operate correctly in the absence of malware) is a big and important effort.

Re:How does an overflow work?

[pegr__]

But you don't have to know exactly where the jmp, etc. is... Pad your exploit code with my favorite instruction, NOP (No OPeration). If you have some idea where the pointer is going to land, just start writing a few hundred/thousand/million NOP's, then your code. As long as the pointer lands in NOP-land, it will eventually get to your code.

Besides, NOP is one of the FASTEST executing instructions there is! I use them in all my programs to enhance performance...

Re:OpenSSH as well

[CausticWindow]

It's a paradox that people who are so paranoid when it comes to security (there are no proof of concept remote exploits for either of these holes), would download patches from where ever and who ever.

Posts like the parent ("get latest patch from me!") always get moderated up, so there must be somebody downloading and installing them. Maybe I shouldn't give people ideas.

Re:Patch delivery mechanism

[OrenWolf]

There sure is!

RHN Update Agent

Re:Patch delivery mechanism

[Jhon]

Depends on your distro. up2date for RH is a good example.

This is a really difficult one

[heironymouscoward]

A serious response to the story is too bleak. Ho-hum, upgrade sendmail, patch it, OK.

Comedy is inappropriate. "Is that sendmail dead? No, it's just sleeping. Oh, I could swear it was dead! No, it's just tired, see? Sendmail gottan exploit, sendmail gottan exploit!"

Irony is difficult. To be honest, I can't even be sure which ironic form I would employ in this case. Forget irony.

Sarcasm? "Sendmail, yeah, like we're still using that dinosaur!" What, we are? Dang. Why? "Cause it was there?" What kind of an excuse is that?!

Nihilism... "yes, another day, another exploit. ssh, now sendmail. I can just see the future, one long bitter trail of unpatched software, server after server to upgrade. brain the size of a planet, and here I am, patching sendmail. what's the use, I ask you...?"

Slashdotisms? All your sendmail overlords are 1-2-3 profit to us? Imagine? In Russia? No, no, no.

SCO! SCO! "It's not an exploit, it's a snippet!!!" Worth a try.

Damn you to the deepest depths of hell, Slsadhot edirots, this story has so little karma leverage it hurts.

Re:Patch delivery mechanism

[Anonymous Coward]

> Does Linux have an Auto-update mechanism similar to
> windows that indicates when new patches are available
> for download?

Yup. it's called "slashdot"

Re:OpenSSH as well

[(startx)]

and it's allready been updated in slackware as well. Go Pat!

Before the Microsoft defenders say it...

[ReelOddeeo]

Before all the Microsoft apologists jump in and point out that any system can have vulnerabilities, and Linux users should not bash Microsoft.

It is true that any system can have unintentional bugs that lead to security vulnerabilities. This is true of any system and not just Microsoft. Therefore, Microsoft should not be unfairly bashed due to these kinds of bugs, any more than any other system.

But there is another kind of security problem for which Microsoft is deservedly bashed. The problem Microsoft is bashed for having poor security is when their system is insecure in its design. (It may not have been a design goal.)

Examples would include, running a webserver under the System or Administrator account so that once it is compromised, the system is rooted. Installing and activating services by default. These problems are all caused by security having a low priority in the past, and Microsoft is deservedly bashed for these. Nimbda or Slammer may be buffer overflows which could happen to anyone, but there is some deserved criticism as to why it was such a huge problem.

No doubt, sendmail also deserves some criticism.

I wonder how many Linux/Apache systems get web pages defaced via. SQL injection or other PHP related attacks, but do not lead to the box being rooted? Any numbers?

Re:Before the Microsoft defenders say it...

[TheNetAvenger]

But there is another kind of security problem for which Microsoft is deservedly bashed. The problem Microsoft is bashed for having poor security is when their system is insecure in its design. (It may not have been a design goal.)

Although you have good motives in this post, you have no idea what you are talking about in regard to Microsoft's OS architectural security and its history.

Sure Win9x and Win3.x and DOS are INHERENTLY insecure, as they were designed with a closed system architecture in mind and an evolution of a closed system OS. Just like Mac System software has almost no inherent underlying security. (i.e. they were not designed for security or rigid network security since many of the networking concepts that are common today were not available or widely used when they were originally designed in the 80s. As most home users concepts of networks were CompuServe and BBSes.)

However, the NT architecture and security model that it was designed upon had security as a main priority from its original designs. In fact the Object Oriented/Token based security model that is in the NT base (and the original NT 3.1) are not only conceptually more advanced than the *nix security model, but they also have been successfully implemented to be one of the most secure OS designs in history.

The designers of the NT security model took 'conceptual' ideas of the 'ideal' methodologies for a robust and strong underlying security structure and designed these into the OS from day one.

This is why people like Dave Cutler and other 'respected' Unix and OS engineers at the time that were hired by Microsoft ABANDONED the *nix security models to build an OS using the new theories of OS security and implement them in the NT kernel architecture.

As for backing my claims, I suggest an original text like "Inside Windows NT" - The original 1993 release and the recent updated releases that cover the newer NT code bases - Windows 2000, XP, and 2003.

The OS designers at Microsoft had full control to make NT based upon *nix concepts and technologies if that was what they thought was the most advanced conceptual OS engineering; however, they rejected taking the *nix route and instead went for OS architectural concepts that were on the forefront of technological theory and hadn't even been implemented in a real OS to the extent they were in NT.

As you can see from many of my posts here, I am not a hard core Microsoft or NT zealot, but when I see people just dismiss technologies because they take the popular misconceptions I feel the need to respond.

Even if you hate NT and Microsoft, I truly do hope you will explore what TRULY is in NT in terms of security and its security model for your own knowledge.

Especially considering any information you or someone else reading this post gain from it might be compelled to use some of the Microsoft NT concepts in other OS coding and designs to create richer OS environments for everyone, whether it be MacOSX, Linux, or BeOS.

Even if you take odds and dismiss the intellectuals that designed NT, there is always the chance the Microsoft team did do something innovative or right that can also benefit future OS architectural models.

Take Care,
TheNetAvenger

Spam, spam, spam and spam

[Serious Simon]

I experience daily buffer overflows receiving mail.

Re:I use...

[1010011010]

If you can edit a .cf file by hand, you've earned the right to run it. :) And the punishment of running it.

Acutally their is a BIND9 patch today...

[HaeMaker]

A fix for the "all your misspellings are beloning to us" Verisign hack.

Re:Patch delivery mechanism

[sg_oneill]

apt-get update
apt-get upgrade

Stick it in a cronjob.

Solved :)

I didn't realize Microsoft wrote sendmail!

[Junks Jerzey]

But they must have, because there are no bugs in any software that runs under Linux. There never have been, and there never will be.

Re:HUH?

[athen66]

that's pretty sad if you think "a lot" and "allot" mean the same thing. go back to kindergarten.

This was mentioned on bugtraq

[Anonymous Coward]

Sendmail 8.12.9 prescan bug

attack details:

Local exploitation on little endian Linux is confirmed to be trivial
via recipient.c and sendtolist(), with a pointer overwrite leading to a
neat case of free() on user-supplied data, i.e.:

eip = 0x40178ae2
edx = 0x41414141
esi = 0x61616161

SEGV in chunk_free (ar_ptr=0x4022a160, p=0x81337e0) at malloc.c:3242

0x40178ae2 : mov %esi,0xc(%edx)
0x40178ae5 : mov %edx,0x8(%esi)

Remote attack is believed to be possible.
It also seems that a CS student from the university of Sweden has posted a working exploit on this web site. Scary stuff. So patch your system, people!

You know...

[Gay Nigger]

I feel like my week isn't complete without patching Sendmail at least once. Ahhh... return to normalcy. I feel better.

Re:Patch delivery mechanism

[mopslik]

...you must give Microsoft credit. When an exploit is made public, they already have the patch ready.

You mean when Microsoft publicly discloses the exploit, usually weeks after it was first reported across the Internet?

OMFG

[lspd]

When did everyone decide the standard way of fixing security bugs was no longer worth the effort. You don't release a new version with a security bug fixed until all the distros have been contacted and the fix has been backported. Why have Sendmail and OpenSSH decided this no longer applies to them? Is Apache next? Are they going to force an upgrade to Apache 2 by rolling security fixes into beta versions and not bothering to tell anyone before they are released?

Re:What Sendmail security problem?

[__past__]

I'm a happy postfix user myself, but it should be noted for fairness reasons that the last postfix-related advisories are about two weeks old... Face it, some software may be better than others, but no matter what you are running, you'll always have to keep your systems up to date. Looking down on others because the software they run is oh so insecure and yours is perfect is the first step to being rooted.

Look I know

[IWantMoreSpamPlease]

that many in the Open Source Community are content to imitate Microsoft's latest offerings, but copy exploits is, in my opinion, going too far! ;-)

Re:OpenSSH as well

[lone_marauder]

What?? You don't trust software compiled by flying butt monkeys?

difference between MS bugs and OS bugs

[Twister002]

The big difference between bugs found in MS products and bugs found in Open Source products seems to be: Bugs in Open Source products seem to make the /. front page the same day a patch is released. MS product bugs are posted about days before a patch comes out.

Of course that could be because the OS projects fix their bugs as soon as they find them rather than having to wait for the red tape to clear up.

Re:Patch delivery mechanism

[Chupa]

You obviously have no first-hand experience with Debian systems. Security updates for the current stable branch are always released within a day or two of any sort of advisory (usually on the same day). The security patches are often backported to older versions rather than just using the newest version of the software. This makes life easy many admins, as new versions of software can be non-backwards compatible or behave differently than older versions.

And if you don't mind this, you can always use the "testing" or "unstable" branches for cutting-edge software.

Besides the fact that Debian is extremely easy to update:

apt-get update
apt-get upgrade

Know what you are talking about before you speak.

Re:Patch delivery mechanism

[metamatic]

Yes.

Debian: apt-get update
Gentoo: emerge sync
RedHat: up2date, or autorpm, or apt-get update
SuSE: you, or autorpm
Mandrake: urpmi update

You can get autorpm to e-mail you a daily summary too.

Re:OpenSSH as well

[RevMike]

It's a paradox that people who are so paranoid when it comes to security (there are no proof of concept remote exploits for either of these holes), would download patches from where ever and who ever.

One of the pluses of open source is that you have the ability to look at the code and determine exactly what the patch changes. For a small patch most sysadmins, even though they might not be an "elite" programmer, can determine that the code does some extra boundary checking or the like.

I would hope that sysadmins do this before installing code from an unknown source.

Re:How does an overflow work? [+LINK]

[danigiri]

I was in obscurity as well until I read this this story.

It is a story about a detailed PDF on MacOSX/Darwin+PPC specific ways to run malignant code once and if an exploit is found. The posting is somewhat misleading, the PDF is not about vulnerabilities at all but what to do once they are found, as some reply clarifies.

I am pretty sure that similar docs exist for Linux+i386 and a-plenty of other architectures (MS Wind anyone?).

Dani++

Wow

[Black Noise]

Sendmail states this is potentially remotely exploitable

Wow, sendmail must've come a long way since I last used it...
Now tell me why not all software has this feature.

I suspect this story is fradulent

[RLiegh]

as I cannot believe that sendmail would have an exploit (remote or otherwise) given its' history.

Why sendmail anyway?

[ArchAngelQ]

Sendmail has remote exploits every couple of months at best. Why is anyone suprised any more? It's not as if it's easy to set up, administrate or is horribly high performance. It's about as middle of the road as you get. As many have pointed out before I'm sure, this is exactly why we complain about software from microsoft (and I mean just the software, not it's licences nor the biz tactics associated with it).

So why not look for alternatives, all you sysadmins out here? I for one prefer qmail. There are plenty of others.

I know it's hard to switch to a new system when you've gotten profficent in configuring something well, especially when you are so busy using it that you don't have time to play with something new to see if can work for your setup. But I can't see that running a frequently exploited mail server will cause anything but more work.

This is getting silly

[jd]

Sendmail badly needs a severe audit. Maybe Stanford can run their validating compiler over it, or something. Either way, you shouldn't be seeing such basic, fundamental flaws in software that has been around for a long time.

Especially software that is semi-commercial. They're getting paid to check for these issues, after all.

Ok, credit given where credit is due. The problem has been recognised within a short time of being detected. That's better than Hotmail's "check the password? what for?" bug, that persisted for six or seven months, and remained in effect for several days after the media ran the story.

But that's where the credit ends. It shows that the program isn't being routinely tested and verified with overflow detectors, or (if it is), that the testing procedure is inadequate.

It shows why rival MTAs (eg: Postfix) are gaining popularity, when Sendmail could have kept absolute control of the market, merely by being the best.

Re:This is getting silly

[gregarican]

True that about basic fundamental flaws. Reminds me of some project I had to write in college on the old DEC VAX'es. That's about the level of expertise and sophistication exhibited in sendmail.

People bash Micro$loth because their software has an inherently insecure architecture (e.g. - unnecessary services enabled by default, services running with admin rights, etc.), not just being poorly coded. But then again there are some inherent shortcomings in older *NIX software and sendmail is just one example.

Even the Internet as a whole. Back when the Internet was exclusively a failsafe/experimental communication backup for military installations and college campuses it was never meant to be secure in the software sense. It was secure more in terms of physical access. For example, there probably wouldn't be a compromise of an Air Force computer room if external "bad guys" couldn't get physical access into the room and room activities were strictly monitored for internal users. There was never the assumption that the general public would all share remote access to the Internet.

That being said, it will obviously take a massive effort not just to code new software more securely, but to review, patch, or pitch legacy code such as seen in stories like this. Each generation of computer users is savvier and savvier, as most exploits are propagated by kids who toilet paper houses on the weekend. And that is a scary thought if I was Joe Head-up-my-ass PHB too cheap to update/upgrade/migrate software and still running old crap like this.

*nix users vs. Windows proponents

[kupci]

Before all the Microsoft apologists jump in and point out that any system can have vulnerabilities, and Linux users should not bash Microsoft.

Interestingly, *nix users don't seem to howl at Slashdot for publishing every vulnerability that comes along in *nix, rather there are discussions of the best way to patch etc, whereas I've noticed that every time there is an post about the latest Windows/IE/SQL Server/?? hole, there is a deluge of postings from defensive MSFT zealots who loudly complain that the Slashdot world is picking on them. Odd.

Re:OpenSSH as well

[Politburo]

Posts like the parent ("get latest patch from me!") always get moderated up, so there must be somebody downloading and installing them.

Considering that a lot of mods don't even seem to READ the posts they mod, I doubt they checked out the link.

Re:To all the Microsoft bashers out there....

[gtaluvit]

Um...they're called the following:

emerge (Gentoo)
up2date (Redhat)
apt-get (Debian)

I know on the Gentoo side, they had the SSH fix out the same day. There are distribution methods in place, just depends on the distro you use. So just cause Windows Update notifies you that there's an update or even does it automatically, that doesn't stop you from croning the above commands.

Re:To all the Microsoft bashers out there....

[autechre]

Windows Update does not come configured to automatically download and install updates for you. It also does not always work. It has been reported to falsely report that patches are installed, and to prompt to install patches over and over again that are already installed. And how many people, used to an endless barrage of meaningless dialog boxes from Microsoft products (though they are not the only ones who do this), dismissed the auto-updates configuration, and so go unpatched? Additionally, were you aware of the 31 currently unpatched security holes in IE?

http://www.pivx.com/larholm/unpatched/

As for being informed, if Slashdot is your only source for notification about security vulnerabilites, you have bigger problems than a single sendmail exploit.

Why support MS and get spam?

[msimm]

Instead of use bluebottle.com? They have free 10 meg accounts without MS bs or advertising and use a TMDA like system for anti-spam verification. I'll never understand why technical people would use a hotmail account (bluebottle *will* also check your hotmail account for you).

Re:Patch delivery mechanism

[Tet]

apt-get update
apt-get upgrade

Stick it in a cronjob.

Yikes! Remind me to never give you a job as an admin for any of my computers. While that sort of thing might be acceptable for a home desktop, it's suicide on a corporate server...

patch applies to old versions of sendmail

[named]

In case anyone is forced (by legacy apps & shit) to be running old versions of sendmail, the patch supplied applies nicely to version 8.9.x of sendmail. It even continues to work after it's patched.

Not like anyone is going to find this comment so late in the discussion, but...

Perpetual newpaper

[perp]

There was a Dilbert strip where Dogbert tried to sell Dilbert a "perpetual newspaper"; only a thousand dollars and you'll never need to buy another newspaper!

The headlines were like "Pope Denounces Violence" and "Real Estate Values Rise" and "Unrest in the Middle East". I think that "Buffer Overflow Found in Sendmail" would have been a worthy addition to the Tech Pages.

qmail install HOWTO and RPMs

[getnuked]

Here is a HOWTO and a tarball containing all of the files necessary to replace sendmail with qmail on an RPM based system.

Sendmail 5th on the list

[twoslice]

Buffer Overflows in Sendmail rank 5th on this list.

Vulnerability list

There are *TWO* bugs

[V. Mole]

Actuall, more than two: the changelog includes several fixes. Right above the fix you quote, there's one that *is* exploitable, which is why they've gone ahead and released it:

8.12.10/8.12.10 2003/09/24
SECURITY: Fix a buffer overflow in address parsing. Problem
detected by Michal Zalewski, patch from Todd C. Miller
of Courtesan Consulting.

The fact it's separate bugs is clear from the indention in the original (Fscking /. doesn't support PRE)

Re:Can you read?

[ComputerSlicer23]

Uhhh, check the MD5SUM off the original site (Downloading the MD5SUM off the original site, is less load, off the mirror if they have it)? Off the BugTraq list? Off any number of sites. You check the signature of the MD5SUM is from someone you *TRUST*, like the original author, like a security expert on a mailing list, like your distributor. Maybe possibly that's who you would check the signature from? If you go to the trouble of mirroring the original patch, you should grab the *signed* copy of the MD5SUM from the original author (Lots of authors sign their MD5SUM's, the tarballs and patches are all have a signature file on kernel.org for instance). That's how I check all of my ISO's I download, even when it is from the original site. RedHat publically lists them, I just grab the MD5SUM list from them, and I check the signature of the MD5SUM file.

You should do that no matter who you download it from, even from the original site, not that long ago the OpenBSD sites, and the GNU sites we're compromised. So just assuming they had good source, wasn't safe. Then at least you know that whoever wrote the patch, also has the private key of whoever signed it (which hopefully is the person whom you trust). If you are a good little author, you sign with a private key on a machine that you sneaker net the source code to, sign there, then sneaker net it back to the public network (or you just drag the MD5SUM there, instead of the original source). At no point, would you ever put the private key on a machine that has ever been connected to the internet (then you just have to physically secure the machine). It's much, much safer that way. Then nobody can get your key except by crytoanalysis, which needs the force of a major gov't behind it to break 4096 PGP encryption last time I checked.

Honest, I'm not as stupid as you think I am.

Kirby

Yh..... fffsdfksjkldll.... WHAT?

[pr0ntab]

What are you talking about? Can you name a single network operating system since the late 80s that doesn't use virtual memory with 32-bit or larger pointers?!

Who modded this up?

There is no way in hell you'll cause a pointer to wrap around and come back up since if you write to the page mmaped at 0 on essentially every OS out there you get a page fault (and the OS kills the program, Null pointer exception). And before that you walk all over the pages that are between the break and stack, unallocated, or maybe all over the read-only shared libs, and they all will cause page faults and SIGSEGV your ass into next Tuesday.

Here's krog. Krog allocate automatic variable on stack. Stack grow downward. Data fills from lower to upper address (opposite stack growingness). Krog no check length of input. Krog overwrite stack not belonging to his stack frame (previous call). Ooomba, clever hacker, he know offset to return address in leaky function. OOmba, he sendum nasty input Krog no check length on that overwrite return address. When function return, it jump back into buffer instead of last function. Buffer gottem nasty root shell code, not data.

Krog sad.

Ooomba does happy dance.

Yes. Check your inputs.

YES DONT ASSUME YOU KNOW ANYTHING ABOUT HOW LARGE A BUFFER IS

YES, FOR GODS SAKE PEOPLE, NEVER ALLOCATE BUFFERS AS AUTOMATIC VARIABLES ON THE STACK!!! ARE YOU INSANE!!!!!!!!>?>>>>>>>