-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===============================================================================
>>                                                      CERT-NL, 01-Mar-2000 <<
>> All CERT-NL information has been moved to http://cert.surfnet.nl.  Links  <<
>> to CERT-NL information contained in this advisory are therefore outdated. <<
>>                                                                           <<
>> CERT-NL also has stopped the CERT-CC-Mirror service.  Due to this the     <<
>> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the  <<
>> complete CERT-CC advisory texts:                     http://www.cert.org  <<
===============================================================================
===============================================================================
Security Advisory                                                       CERT-NL
===============================================================================
Author/Source : Gert Meijerink & Don Stikvoort          Index: S-95-05.APPENDIX
Distribution  : World                                       Page   :          1
Classification: External                                    Version:          1
Subject       : /bin/mail vulnerabilities (APPENDIX)        Date   :  30-Jan-95
===============================================================================

Issue date: January 26, 1995
 
This file is a supplement to CERT-NL advisory S-95-05, 
"/bin/mail vulnerabilities", and will be updated as additional 
information becomes available.

{Note by courtesy of CIAC - marked ***  --CERT-NL}
{Note by courtesy of DFN CERT - marked &&&  --CERT-NL}

//////////////////////////////

Below is information we have received from vendors who have patches available
or upcoming for the vulnerabilities described in this advisory, as well as
vendors who have confirmed that their products are not vulnerable. If your
vendor's name is not in one of these lists, contact the vendor directly for
information on whether their version of sendmail is vulnerable and, if so, the
status of patches to address the vulnerabilities.

NOT VULNERABLE
- --------------
The following vendors have reported that their products are NOT vulnerable.
         Apple Computer, Inc.
         Berkeley SW Design, Inc. (BSDI)
         Data General Corp.
         Harris
         IBM
         NeXT, Inc.
         Pyramid
         The Santa Cruz Operation (SCO) - not vulnerable, but see note below
         Sun Microsystems, Inc. - Solaris 2.x (SunOS 4.x is vulnerable; see
                                               below)
            &&&  If the patch 102042-01 for SunOS 5.4 (Solaris 2.4) for   &&&
            &&&  "backward compatibility of /bin/mail to 4.x versions"    &&&
            &&&  will make the /bin/mail program vulnerable is not clear. &&&
 
In addition, we have reports that the following products are NOT vulnerable.
         FreeBSD
         NetBSD
     *** Cray Research, Inc. ***
 
 
VULNERABLE
- ----------
We have reports that the following vendors' products ARE vulnerable.
Patch information is provided below.
 
- -----------------------------
Digital Equipment Corporation
 
Vulnerable:  DEC OSF/1 versions 1.2, 1.3, and 2.0
             DEC ULTRIX versions 4.3, 4.3A, and 4.4
 
Obtain and install the appropriate patch according to the instructions
included with the patch. The patch that corrects the /bin/mail problem in each
case is part of a comprehensive Security Enhanced Kit that addresses other
problems as well. This kit has been available since May 17, 1994. It is
described in CERT-NL security advisory S-94-14 of May 18, 1994.
 
        1. DEC OSF/1
           Upgrade/install OSF/1 to a minimum of V2.0 and
           install Security Enhanced Kit CSCPAT_4061 v1.0.
 
        2. DEC ULTRIX
           Upgrade/install ULTRIX to a minimum of V4.4 and
           install Security Enhanced Kit CSCPAT_4060 v1.0.
 
Both kits listed above are available from Digital Equipment Corporation by
contacting your normal Digital support channel or by request via DSNlink for
electronic transfer.
 
- -----------------------------
The Santa Cruz Operation (SCO)
 
SCO's version of /bin/mail is not vulnerable to the problems mentioned
in this advisory. SCO's /bin/mail is not setuid-root. However, SCO's
/bin/mail has other security-related issues that are fixed by SCO's
Support Level Supplement (SLS) uod392a. To get this:
 
ftp:    ftp.sco.COM:/SLS/uod392a.Z      (compressed disk image)
        ftp.sco.COM:/SLS/uod392a.ltr.Z  (cover letter)
        ftp.sco.COM:/SLS/README
 
- -----------------------------
Solbourne
 
Grumman System Support Corporation now performs all Solbourne
software and hardware support. Please contact them for further
information.
 
        ftp: ftp.nts.gssc.com
        phone: 1-800-447-2861
        e-mail: support@nts.gssc.com
 
- -----------------------------
Sun Microsystems, Inc.
 
Current patches are listed below, but they are being revised.
 
        SunOS      Patch              MD5 Checksum
        ------     -----              ------------
        4.1.3      100224-13.tar.Z    90a507017a1a40c4622b3f1f00ce5d2d
        4.1.3UI    101436-08.tar.Z    0e64560edc61eb4b3da81a932e8b11e1
 
     The patches can be obtained from local Sun Answer Centers or under:
     ftp://ftp.nic.surfnet.nl/surfnet/net-security/cert-nl/patches/sun-fixes
 
//////////////////////////////

==============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet
is the Dutch network for educational, research and related institutes. CERT-NL
is a member of the Forum of Incident Response and Security Teams (FIRST).

All CERT-NL material is available under:
  http://cert.surfnet.nl/

In case of computer or network security problems please contact your local
CERT/security-team or CERT-NL  (if your institute is NOT a SURFnet customer
please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).

   Email:     cert-nl@surfnet.nl     ATTENDED REGULARLY ALL DAYS
   Phone:     +31 302 305 305        BUSINESS HOURS ONLY
   Fax:       +31 302 305 329        BUSINESS HOURS ONLY
   Snailmail: SURFnet bv
              Attn. CERT-NL
              P.O. Box 19035
              NL - 3501 DA  UTRECHT
              The Netherlands

NOODGEVALLEN:    06 22 92 35 64      ALTIJD BEREIKBAAR
EMERGENCIES : +31 6 22 92 35 64      ATTENDED AT ALL TIMES
CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES:
THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED*
PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT
TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU.
===============================================================================

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i

iQA/AwUBOL6IDjSYjBqwfc9jEQK4/wCfZHcHMdZXTMqkcPrYNMVXboUZ/uUAnRQD
D3WE2QAJc4ztlPZNnBoaXmbd
=5p9J
-----END PGP SIGNATURE-----