Debian GNU/Linux Sendmail Package Default SASL Password Vulnerability

Bugtraq ID:	11262
Class:	Design Error
CVE:	CVE-2004-0833
Remote:	Yes
Local:	No
Published:	Sep 27 2004 12:00AM
Updated:	Jul 12 2009 07:06AM
Credit:	Hugo Espuny disclosed this vulnerability to the vendor.
Vulnerable:	Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0
Not Vulnerable:

Debian GNU/Linux Sendmail Package Default SASL Password Vulnerability

It is reported that the Sendmail package contained in the Debian GNU/Linux operating system is prone to a default password vulnerability, potentially allowing unauthorized use of the Sendmail MTA. This would likely facilitate UCE (Unsolicited Commercial Email, or SPAM) message relaying through affected installations.

Versions of the Debian Sendmail packages prior to 8.12.3-7.1 for Debian stable (woody), and versions prior to 8.13.1-13 for Debian unstable (sid) are reported vulnerable.

Debian GNU/Linux Sendmail Package Default SASL Password Vulnerability

An exploit is not required.

Debian GNU/Linux Sendmail Package Default SASL Password Vulnerability

Solution:
The vendor has released an advisory (DSA 554-1) along with fixes to address this issue.


Debian Linux 3.0 hppa

• Debian libmilter-dev_8.12.3-7.1_hppa.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_ 8.12.3-7.1_hppa.deb


• Debian sendmail_8.12.3-7.1_hppa.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12. 3-7.1_hppa.deb

Debian Linux 3.0 ppc

• Debian libmilter-dev_8.12.3-7.1_powerpc.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_ 8.12.3-7.1_powerpc.deb


• Debian sendmail_8.12.3-7.1_powerpc.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12. 3-7.1_powerpc.deb

Debian Linux 3.0 s/390

• Debian libmilter-dev_8.12.3-7.1_s390.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_ 8.12.3-7.1_s390.deb


• Debian sendmail_8.12.3-7.1_s390.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12. 3-7.1_s390.deb

Debian Linux 3.0

• Debian sendmail-doc_8.12.3-7.1_all.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/sendmail-doc_8 .12.3-7.1_all.deb

Debian Linux 3.0 arm

• Debian libmilter-dev_8.12.3-7.1_arm.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_ 8.12.3-7.1_arm.deb


• Debian sendmail_8.12.3-7.1_arm.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12. 3-7.1_arm.deb

Debian Linux 3.0 alpha

• Debian libmilter-dev_8.12.3-7.1_alpha.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_ 8.12.3-7.1_alpha.deb


• Debian sendmail_8.12.3-7.1_alpha.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12. 3-7.1_alpha.deb

Debian Linux 3.0 mips

• Debian libmilter-dev_8.12.3-7.1_mips.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_ 8.12.3-7.1_mips.deb


• Debian sendmail_8.12.3-7.1_mips.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12. 3-7.1_mips.deb

Debian Linux 3.0 mipsel

• Debian libmilter-dev_8.12.3-7.1_mipsel.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_ 8.12.3-7.1_mipsel.deb


• Debian sendmail_8.12.3-7.1_mipsel.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12. 3-7.1_mipsel.deb

Debian Linux 3.0 ia-32

• Debian libmilter-dev_8.12.3-7.1_i386.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_ 8.12.3-7.1_i386.deb


• Debian sendmail_8.12.3-7.1_i386.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12. 3-7.1_i386.deb

Debian Linux 3.0 sparc

• Debian libmilter-dev_8.12.3-7.1_sparc.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_ 8.12.3-7.1_sparc.deb


• Debian sendmail_8.12.3-7.1_sparc.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12. 3-7.1_sparc.deb

Debian Linux 3.0 m68k

• Debian libmilter-dev_8.12.3-7.1_m68k.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_ 8.12.3-7.1_m68k.deb


• Debian sendmail_8.12.3-7.1_m68k.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12. 3-7.1_m68k.deb

Debian Linux 3.0 ia-64

• Debian libmilter-dev_8.12.3-7.1_ia64.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_ 8.12.3-7.1_ia64.deb


• Debian sendmail_8.12.3-7.1_ia64.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12. 3-7.1_ia64.deb

Debian GNU/Linux Sendmail Package Default SASL Password Vulnerability

References:

• Debian Security Information (Debian GNU/Linux)
  
• Debian sendmail Package Reference (Debian GNU/Linux)