what you don't know can hurt you


Posted Jan 19, 1994


MD5 | a58d69280288834992acfb8e5f7383b4


Change Mirror Download


I. Sendmail update

A. Summary of ongoing efforts
B. Comments on the recent CERT, CIAC, and NASIRC advisories
C. Workaround needed by some 4.1.x sites to run 100377-07
D. List of platforms, operating system versions, and patches

II. How to obtain Sun security patches

A. If you have a support contract
B. If you do not have a support contract

III. How to report Sun security problems

\\ \ Send Replies or Inquiries To:
\ \\ /
/ \/ / / Sun Security Coordinator
/ / \//\ MS MPK2-04
\//\ / / 2550 Garcia Avenue
/ / /\ / Mountain View, CA 94043-1100
/ \\ \ Phone: 415-688-9081
\ \\ Fax: 415-688-9101
\/ E-mail: security-alert@Sun.COM


This information is only to be used for the purpose of alerting Sun
customers to problems. Any other use or re-broadcast of this
information without the express written consent of Sun Microsystems
shall be prohibited. Sun Microsystems expressly disclaims all liability
for any misuse of this information by any third party.

Sun Microsystems recommends that all customers concerned with the
security of their SunOS system(s) obtain and install all patches that
are applicable to their computing environment.


I. Sendmail update

Many Sun customers have asked for an update concerning the security
holes in sendmail. This bulletin summarizes the state of our work
to close those holes. No new vulnerabilities are discussed.

We also provide in this bulletin a workaround for the benefit of
customers whose mail system configurations proved incompatible with
patch 100377-07 (see section C below).

A. Summary of ongoing efforts

Since the release of Sun's 21 October sendmail patch (see our
bulletin #122), sendmail has been closely scrutinized for possible
security holes. As a result of this scrutiny, new bugs--both
generic and Sun-specific--have come to light.

We are now working on fixes for the newly-discovered bugs in our
version of sendmail, and will release a patch as soon as testing
is complete. In this effort we are collaborating with several
external sendmail experts; CERT; and, through CERT, with other
UNIX vendors.

We expect to release the next sendmail patch in seven to ten
days--that is, about 19 November. However, the release may be
delayed if more holes are discovered in the interim or if the
known bugs prove more difficult than expected to resolve. We will
announce the patch in a bulletin similar to this one.

B. Comments on the recent CERT, CIAC, SERT, and NASIRC advisories

Several customers have asked this office to comment on the recent
advisories (CERT CA 93:16; CIAC E-03; SERT SA-93.10; and NASIRC
#96-06). These bulletins state that every commercial sendmail has
known security holes. Most recommend that sites consider some
additional security measures, such as running the 8.6.4 sendmail
(and perhaps the new smrsh program) from Berkeley.

Beyond recommending that customers apply the Sun patches and
follow documented procedures, we cannot give advice. But here is
what we know.

1. The sendmail patches we released on 21 October fixed all of
the security holes we were aware of at that time. The next
patch will fix all of the holes we are aware of now.

2. As of this writing we are aware of no reports from Sun
customers concerning undesirable interactions with the Berkeley
software, or of any unanticipated side effects, or bugs,
associated with the smrsh program.

3. The CERT advisory, in particular, contains sound advice
prepared by recognized experts in the field. In light of the
unavoidable delay until the release of our next patch, we
suggest that every customer carefully evaluate the alternatives
presented there.

Lastly--while taking no position on the use of the smrsh program
itself--we recommend extreme caution in the selection of those
programs for which remote execution is allowed.

C. Workaround needed by some 4.1.x sites to run 100377-07

Some of our customers have experienced problems after installing
sendmail patch 100377-07 (SunOS 4.1.x). These problems result from
an undocumented change--a correction, in fact--to the behavior of
the "$%y" operator in subsidiary sendmail.cf files. We apologize
for our previous oversight in not documenting the change.

Under the old interpretation of "$%y", only unqualified names,
presumably indicating hosts on the local Ethernet segment, would
match, thus getting local delivery. Using the new interpretation
of "$%y", any name which succeeds in a "gethostbyname" call (which
is any valid DNS name if DNS forwarding through NIS is enabled)
will match, so the "subsidiary" file is fooled into thinking all
Internet hosts are "local". In this case mail cannot successfully
be delivered by the subsidiary host.

This problem does not arise on Solaris 2.x systems.

We recommend the following workaround (on "subsidiary" systems

1. Become root. Make a backup copy of your /etc/sendmail.cf
file, with a command such as:

%cp /etc/sendmail.cf /etc/sendmail.cf-FCS

2. Edit the /etc/sendmail.cf file, adding one line and changing
approximately two others. The line to be inserted is:


and it is most conveniently placed directly after the comment,
"#known hosts in this domain are obtained from gethostbyname()
call". This comment is found in line 52 in the sample .cf file.

In that same file, replace all references (there are two in the
sample file) from "$%y" to "$%Y". (That is, change references
to the lower-case y operator so that they instead refer to the
newly defined upper-case Y macro.)

3. Kill and restart sendmail. Be sure to supply the appropriate
command line options. You can get these either from your
rc.local file or via a command like "ps -auxw | grep

Sun Microsystems wishes to acknowledge the contributions of
customers Paul Quare, Greg Jumper, and Logan Thomas in the
development and testing of this workaround.

Please direct any comments or questions to your local answer

D. List of platforms, operating system versions, and patches

1. Platforms. Sun has now made the sendmail security patches
available on its sun3 and x86 architectures. All supported
architectures (sun3, sun4, and x86) now have patches.

A sun3 version has been added to the existing patch 100377-07.
The bug ID for all 4.1.x platforms is 1144946.

The patch for the x86 platform is 101352-01, as shown below.
The bug ID for all Solaris 2.x platforms is 1142888. Note that
this patch also includes an x86 fix for the tar security bug
discussed in the 21 October bulletin.

2. OS Versions. Sendmail patches are available for the
following versions of the operating system: 4.1.1, 4.1.2,
4.1.3, 5.1 (Solaris 2.1) and 5.2 (Solaris 2.2). No 5.3 (Solaris
2.3) version of the existing patch is available; but 5.3 will
be included in all future sendmail patches.

No patches will be produced for SunOS 4.1, or earlier versions
such as 4.0.3.

Running the 4.1.1 version on a 4.1 system is not a supported
configuration and we cannot recommend it. Many customers who
have tried it report that it works satisfactorily, despite the
many error messages (displayed when the program starts up)
complaining about old library versions. For further information
on this subject please contact your local answer center.

3. Patches. Available patches are tabulated below. Note that the
checksum for 100377-07.tar.Z is different than that shown in our
bulletin of 21 October because of the addition of the sun3 patch.

System Patch ID Filename BSD SVR4
Checksum Checksum
------ -------- --------------- --------- -----------
SunOS 4.1.x 100377-07 100377-07.tar.Z 39017 741 6982 1482
Solaris 2.1 100840-03 100840-03.tar.Z 01153 194 39753 388
Solaris 2.2 101077-03 101077-03.tar.Z 49343 177 63311 353
Solaris x86 101352-01 101352-01.tar.Z 31564 551 37608 1101

The checksums shown above are from the BSD-based checksum
(on 4.1.x, /bin/sum; on Solaris 2.x, /usr/ucb/sum) and from
the SVR4 version on Solaris 2.x (/usr/bin/sum).

II. How to obtain Sun security patches

A. If you have a support contract

Customers with Sun support contracts can obtain the patches listed
here--and all other Sun security patches--from:

- Local Sun answer centers, worldwide
- SunSolve Online

Please refer to the bug ID and patch ID when requesting patches
from Sun answer centers.

You should also contact your answer center if you have a support
contract and:

- You need assistance in installing a patch
- You need additional patches
- You want an existing patch ported to another platform
- You believe you have encountered a bug in a Sun patch

B. If you do not have a support contract

Sun also makes its security patches available to customers who do
not have a support contract, via anonymous ftp:

- In the US, from /systems/sun/sun-dist on ftp.uu.net
- In Europe, from ~ftp/sun/fixes on ftp.eu.net

Patches announced in a Sun security bulletin are uploaded to these
two sites just before the bulletin is released, and seldom updated.
In contrast, the "supported" patch databases are refreshed nightly,
and will often contain newer versions of a patch incorporating
changes which are not security-related.

III. How to report Sun security problems

If you discover a security problem with Sun software, please contact
one or more of the following:

- Your local Sun answer centers, worldwide
- Your representative computer security response team, such as CERT
- This office. Address postal mail to:

Sun Security Coordinator
MS MPK2-04
2550 Garcia Avenue Mountain
View, CA 94043-1100

Phone: 415-688-9081
Fax: 415-688-9101
E-mail: security-alert@Sun.COM


If you received this bulletin indirectly, and would like to be added
to Sun's Customer Warning System mailing list, send a request to the
address above with your affiliation and contact information. If you
have e-mail access, send mail to "security-alert@Sun.COM" with the
subject "subscribe" and your affiliation and contact information in
the message body.
Login or Register to add favorites

File Archive:

January 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    0 Files
  • 3
    Jan 3rd
    20 Files
  • 4
    Jan 4th
    4 Files
  • 5
    Jan 5th
    37 Files
  • 6
    Jan 6th
    20 Files
  • 7
    Jan 7th
    4 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    0 Files
  • 10
    Jan 10th
    18 Files
  • 11
    Jan 11th
    8 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    31 Files
  • 14
    Jan 14th
    2 Files
  • 15
    Jan 15th
    2 Files
  • 16
    Jan 16th
    2 Files
  • 17
    Jan 17th
    18 Files
  • 18
    Jan 18th
    13 Files
  • 19
    Jan 19th
    15 Files
  • 20
    Jan 20th
    29 Files
  • 21
    Jan 21st
    12 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    17 Files
  • 25
    Jan 25th
    34 Files
  • 26
    Jan 26th
    23 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2020 Packet Storm. All rights reserved.

Security Services
Hosting By