Berkeley Sendmail Group Permissions Vulnerability

Bugtraq ID:	715
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 03 1996 12:00AM
Updated:	Dec 03 1996 12:00AM
Credit:	This vulnerability was first published in an advisory by AUSCERT on 3 December 1996.
Vulnerable:	Sun SunOS 4.1.4 Sun SunOS 4.1.3 _U1 Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 Sun Solaris 2.3 SCO Open Server 5.0.2 SCO Open Server 5.0 SCO Internet FastStart 1.1 SCO Internet FastStart 1.0 IBM AIX 4.2 IBM AIX 4.1 IBM AIX 3.2 HP HP-UX 10.20 HP HP-UX 10.16 HP HP-UX 10.10 HP HP-UX 10.1 0 HP HP-UX 10.0 FreeBSD FreeBSD 2.1.6 .1 FreeBSD FreeBSD 2.1.6 FreeBSD FreeBSD 2.1.5 Eric Allman Sendmail 8.8.3 Eric Allman Sendmail 8.8.2 Eric Allman Sendmail 8.8.1 Eric Allman Sendmail 8.8 BSDI BSD/OS 2.1
Not Vulnerable:	Eric Allman Sendmail 8.8.4

Berkeley Sendmail Group Permissions Vulnerability

This description was taken from the AUSCERT advisory.

When delivering mail to a program listed in a .forward or :include: file, that program is run with the group permissions possessed by the owner of that .forward or :include: file. The owner of the file is used to initialize the list of group permissions that are in force when the program is run. This list is determined by scanning the /etc/group file.
It is possible to attain group permissions you should not have by linking to a file that is owned by someone else, but on which you have group write permissions. By changing that file you can acquire the group permissions of the owner of that file.

Berkeley Sendmail Group Permissions Vulnerability

See discussion.

Berkeley Sendmail Group Permissions Vulnerability

Solution:
It is advised to upgrade to version 8.8.4 of sendmail or install a vendor supplied patch.

Berkeley Sendmail Group Permissions Vulnerability

References: