| Description: | Description:
The remote host is missing updates announced in
advisory CLA-2003:571.
Sendmail[1] is a widely used Mail Transfer Agent (MTA).
Researchers at ISS[2] discovered and published[3] a remote
vulnerability[4][5] in sendmail that could be used by an attacker to
execute arbitrary code as root.
This vulnerability can be exploited by creating and sending to a
vulnerable sendmail server a carefully crafted email message. This
message will trigger the vulnerability and arbitrary commands can be
executed with administrative privileges.
Please note that non-vulnerable mail servers can be used to pass such
messages along so that, for example, even internal sendmail servers
could be reached.
Starting with Conectiva Linux 7.0, sendmail is no longer the default
mail server and has been replaced with Postfix. But sendmail is still
shipped in all Conectiva Linux versions.
As with many other services, the email service, even if installed, is
not started by default in Conectiva Linux.
The Common Vulnerabilities and Exposures (CVE) project has assigned
the name CVE-2002-1337[7] to this issue.
Solution:
The apt tool can be used to perform RPM package upgrades
by running 'apt-get update' followed by 'apt-get upgrade'
http://www.sendmail.org/
http://www.iss.net/
http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21950
http://www.cert.org/advisories/CA-2003-07.html
http://www.kb.cert.org/vuls/id/398025
http://www.sendmail.com/security/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1337
https://secure1.securityspace.com/smysecure/catid.html?in=CLA-2003:571
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003
Risk factor : Critical
CVSS Score:
10.0
|
