Subject: AIX sendmail is DANGEROUS !!!

From: Jan Labanowski <[email-masked]>
Date: Tue, 23 Nov 1993 12:03:59 -0500

Dear Netters,
Pedro  Vazquez agreed to share some comments on sendmail vulnerability
with AIX. I do not quote the prescription on how to use sendmail to
do ANYTHING with ROOT priviledges on the RS/6000 under AIX to protect
the innocent (you do not need to know this, do you?). However
you should replace the sendmail which you have now with a new version (8.6.4).
Moreover, the way to use a sendmail bug to break into your machine
was widely publicized on the Usened. So beware, jerks may know about it...
If you need more info, contact Pedro directly.

Some comments from Pedro:
From: Pedro A M Vazquez <[email-masked]>
>Dear Jan:
>  I've just mailed the message below to the CERT people (...)
> I think all AIX users may be in danger, many of the our list coleagues
> use AIX machines but do not receive CERT reports (...)
> I have compiled sendmail 8.6.4 for AIX machines and I can make it availble
> in binary form for anonymous ftp.
>Regards
>Pedro

Thanks again Pedro for all your help...
Jan
[email-masked]

---

From: [email-masked] (Peter Shenkin)
Date: Tue, 23 Nov 93 14:11:06 -0500

> From: Jan Labanowski <[email-masked]>
> 
> Dear Netters,
> with AIX. .....

About two weeks ago CERT issued an advisory to the effect that
virtually all vendors' sendmails are vulnerable, so this is not news.
CERT proposed several workarounds;  please see their advisory for
details.  In addition, several vendors (SGI, for example;  I don't 
know about IBM) have made new versions of sendmail available, in some 
cases by anonymous ftp.

There was another, similar advisory about the xterm program.

Bottom line:  unless you have reason to believe otherwise, assume
that your sendmail and xterm programs pose security threats.

	-P.
************************f*u*cn*rd*ths*u*cn*gt*a*gd*jb************************
Peter S. Shenkin, Box 768 Havemeyer Hall, Dept. of Chemistry, Columbia Univ.,
New York, NY  10027;  [email-masked];  (212) 854-5143
********************** Atheist: an evangelical agnostic. ********************