ID de Prueba:	1.3.6.1.4.1.25623.1.0.51399
Categoría:	Conectiva Local Security Checks
Título:	Conectiva Security Advisory CLA-2003:571
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory CLA-2003:571. Sendmail[1] is a widely used Mail Transfer Agent (MTA). Researchers at ISS[2] discovered and published[3] a remote vulnerability[4][5] in sendmail that could be used by an attacker to execute arbitrary code as root. This vulnerability can be exploited by creating and sending to a vulnerable sendmail server a carefully crafted email message. This message will trigger the vulnerability and arbitrary commands can be executed with administrative privileges. Please note that non-vulnerable mail servers can be used to pass such messages along so that, for example, even internal sendmail servers could be reached. Starting with Conectiva Linux 7.0, sendmail is no longer the default mail server and has been replaced with Postfix. But sendmail is still shipped in all Conectiva Linux versions. As with many other services, the email service, even if installed, is not started by default in Conectiva Linux. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2002-1337[7] to this issue. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://www.sendmail.org/ http://www.iss.net/ http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21950 http://www.cert.org/advisories/CA-2003-07.html http://www.kb.cert.org/vuls/id/398025 http://www.sendmail.com/security/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1337 http://www.securityspace.com/smysecure/catid.html?in=CLA-2003:571 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003 Risk factor : Critical CVSS Score: 10.0
Referencia Cruzada:	BugTraq ID: 6991 Common Vulnerability Exposure (CVE) ID: CVE-2002-1337 AIX APAR: IY40500 http://www-1.ibm.com/support/search.wss?rs=0&q=IY40500&apar=only AIX APAR: IY40501 http://www-1.ibm.com/support/search.wss?rs=0&q=IY40501&apar=only AIX APAR: IY40502 http://www-1.ibm.com/support/search.wss?rs=0&q=IY40502&apar=only http://www.securityfocus.com/bid/6991 Bugtraq: 20030303 Fwd: APPLE-SA-2003-03-03 sendmail (Google Search) http://marc.info/?l=bugtraq&m=104678862109841&w=2 Bugtraq: 20030303 sendmail 8.12.8 available (Google Search) http://marc.info/?l=bugtraq&m=104673778105192&w=2 Bugtraq: 20030304 GLSA: sendmail (200303-4) (Google Search) http://marc.info/?l=bugtraq&m=104678862409849&w=2 Bugtraq: 20030304 [LSD] Technical analysis of the remote sendmail vulnerability (Google Search) http://marc.info/?l=bugtraq&m=104678739608479&w=2 Caldera Security Advisory: CSSA-2003-SCO.5 ftp://ftp.sco.com/pub/updates/UnixWare/CSSA-2003-SCO.5 Caldera Security Advisory: CSSA-2003-SCO.6 ftp://ftp.sco.com/pub/updates/OpenServer/CSSA-2003-SCO.6 http://www.cert.org/advisories/CA-2003-07.html CERT/CC vulnerability note: VU#398025 http://www.kb.cert.org/vuls/id/398025 Conectiva Linux advisory: CLA-2003:571 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000571 Debian Security Information: DSA-257 (Google Search) http://www.debian.org/security/2003/dsa-257 FreeBSD Security Advisory: FreeBSD-SA-03:04 HPdes Security Advisory: HPSBUX0302-246 http://marc.info/?l=bugtraq&m=104679411316818&w=2 ISS Security Advisory: 20030303 Remote Sendmail Header Processing Vulnerability http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21950 http://frontal2.mandriva.com/security/advisories?name=MDKSA-2003:028 NETBSD Security Advisory: NetBSD-SA2003-002 ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-002.txt.asc https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2222 http://www.redhat.com/support/errata/RHSA-2003-073.html http://www.redhat.com/support/errata/RHSA-2003-074.html http://www.redhat.com/support/errata/RHSA-2003-227.html SGI Security Advisory: 20030301-01-P ftp://patches.sgi.com/support/free/security/advisories/20030301-01-P SuSE Security Announcement: SuSE-SA:2003:013 (Google Search) http://www.iss.net/security_center/static/10748.php
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.