| Title: | Sendmail, Inc. Patch for MIME Buffer Overflows |
| Date Issued: | August 11, 1998 |
| Last Modified: | August 13, 1998 |
| Code: | AA-98.04 |
| Source: | AusCERT |
-----BEGIN PGP SIGNED MESSAGE-----
- -----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AA-98.04 AUSCERT Advisory
Sendmail, Inc. Patch for MIME Buffer Overflows
11 August 1998
Last Revised: -- 13 August 1998
- - ---------------------------------------------------------------------------
Buffer overflow vulnerabilities in several email clients have recently
been made public. Sendmail, Inc. has produced a patch for version
8.9.1 of sendmail to assist sites in pro-actively defending against
these problems. This is not a sendmail vulnerability.
Sites using sendmail are encouraged to upgrade to version 8.9.1 if
possible and install this patch to add an extra layer of defence.
Sites who choose not to will not increase their security exposure in
this case. (Sites contemplating upgrading from versions prior to
8.9.n should be mindful that there may be other non-security issues
that will need to be addressed. Please consult the documentation for
version 8.9.1.)
- - ---------------------------------------------------------------------------
1. Description
Recently the Oulu University Secure Programming Group reported
security vulnerabilities (specifically buffer overflows) in
several MIME compliant email clients. This work triggered
advisories from several response teams, and has lead to further
discussion in public mailing lists.
The vendors of sendmail, Sendmail Inc., have produced a patch for
version 8.9.1 of sendmail to further address this problem. The
patch is intended to allow sites using sendmail version 8.9.1
to offer a further layer of protection to their site to protect
mail clients against the problems that have been made public.
Specifically, the patch will truncate long MIME headers before
they arrive in end users' mailboxes based on the setting of a new
option.
The release of this patch should not be construed as an
indication that sendmail is vulnerable to the problems under
discussion. Sendmail Inc. has released the patch as a service
to their user base to assist system administrators in pro-actively
addressing the problem. Sites who choose not to install the
patch at this time will not increase their exposure to the
problem in this case.
2. Impact
This is a pro-active patch release. Sendmail version 8.9.1 is
itself believed to be unaffected by the problems under discussion.
3. Workarounds/Solution
Sites who do not use sendmail do not need to take any steps based
on this advisory.
Sites who do use sendmail only need to install the the patch
outlined in this advisory if they wish to add an extra layer of
defence against the buffer overflow problems discussed earlier.
Sites who choose not to install the patch to sendmail will not
increase their exposure in this case.
Sites using sendmail who wish to add an extra layer of protection
against the buffer overflow problems discussed recently should do
the following:
(a) Upgrade to sendmail version 8.9.1. Sites contemplating
upgrading from versions prior to 8.9.n should be mindful that
there may be other non-security issues that will need to be
addressed. Please consult the documentation for version 8.9.1.
(b) Download and apply the patch available from one of the
following blocks of URLs:
http://www.sendmail.com/sendmail.8.9.1a.html
http://www.sendmail.com/sendmail.8.9.1a.patch
http://www.sendmail.com/sendmail.8.9.1a.patch.sig
ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.9.1a.patch.README
ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.9.1a.patch
ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.9.1a.patch.sig
(c) Create a new site.config.m4 file in the BuildTools/Site directory
or append to an existing site.config.m4 file with the
following line:
APPENDDEF(`confENVDEF', `-D_FFR_MAX_MIME_HEADER_LENGTH=1')
The -D flag is necessary to tell sendmail to compile in the
new changes.
(d) Compile sendmail using the following command from inside the src
subtree:
./Build -c
The -c flag is necessary to tell sendmail to recompile the
binary from scratch using the new site.config.m4 file.
If you don't include this flag in the compilation, you will
not get the new feature.
(e) Include the following option in the sendmail configuration
file:
O MaxMimeHeaderLength=256
O MaxMimeHeaderLength=256/128
Note: Only include one of these lines - do not include both.
The numeric arguments may be varied by sites. The values
supplied are recommended values only.
The first argument (in this case 256) is the maximum header
length, and the second (128) is the maximum field length of a
parameter within the header (e.g. filename=foo is a parameter
of the Content-Disposition header). In the first form of the
option where no maximum field length is given, sendmail will
use half of the maximum header length. By default, these
values are 0 meaning no checks are done.
(f) Restart sendmail using the newly compiled code.
Note that the patch is specific to sendmail version 8.9.1 only.
If you are unable to upgrade to this version, do not attempt to
use the patch.
4. Further Information
Further information on the buffer overflow problems referred to in
this advisory may be found at the following URLs:
ftp://ftp.auscert.org.au/pub/auscert/advisory/AA-98.02.Outlook.buffer.overflow
http://www.cert.org/advisories/CA-98.10.mime_buffer_overflows.html
http://ciac.llnl.gov/ciac/bulletins/i-077a.shtml
http://www.ciac.org/ciac/MIMEfaq.html
http://www.microsoft.com/ie/security/oelong.htm
http://www.netscape.com/products/security/resources/bugs/longfile.html
Sendmail is mirrored at the following URLs:
ftp://ftp.auscert.org.au/pub/mirrors/ftp.sendmail.org/sendmail/
ftp://ftp.cert.dfn.de/pub/tools/net/sendmail/
- - ---------------------------------------------------------------------------
AUSCERT thanks Eric Allman and Greg Shapiro of Sendmail, Inc., Marko
Laakso of the University of Oulu, the CERT Coordination Center, and
DFN-CERT for their assistance in the development of the patch and this
advisory.
- - ---------------------------------------------------------------------------
The AUSCERT team have made every effort to ensure that the information
contained in this document is accurate. However, the decision to use the
information described is the responsibility of each user or organisation.
The appropriateness of this document for an organisation or individual
system should be considered before application in conjunction with local
policies and procedures. AUSCERT takes no responsibility for the
consequences of applying the contents of this document.
If you believe that your system has been compromised, contact AUSCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).
AUSCERT is located at The University of Queensland within the Prentice
Centre. AUSCERT is a full member of the Forum of Incident Response and
Security Teams (FIRST).
AUSCERT maintains an anonymous FTP service which is found on:
ftp://ftp.auscert.org.au/pub/. This archive contains past SERT and AUSCERT
Advisories, and other computer security information.
AUSCERT also maintains a World Wide Web service which is found on:
http://www.auscert.org.au/.
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AUSCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for emergencies.
Postal:
Australian Computer Emergency Response Team
Prentice Centre
Brisbane
Qld. 4072.
AUSTRALIA
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Revision History
13-Aug-98: Added pointer to CERT MIME client advisory.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- -----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key
iQCVAwUBNdMZtCh9+71yA2DNAQESDQP6AxjFmOr0zNh6EajdV8g2l5lPawXAXVSB
OnJPeF44raZP62GBti5ImHuGidZg0FBeT1AdKIqzDePd/IJ6eZwUfmYYvnfrC0zu
N00Ej8bKWMt9pY/l1WDIi8meRU5DHMFLP0gm8G6/pphvRT5tOsOpXN2b53oqA2bc
XAvTjcwuGDI=
=XlG6
- -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key
iQCVAwUBNdgVtSh9+71yA2DNAQES5wP/VU7t9fEYuwKyLi9U1Eyx6vCeMR7cW2ZT
A1YYrSVrfwZJMFllItfrK7bJGW86qNnKMc1KocqE2MmyawR4REGjCSiqRm8k/mQx
pVyyT+EhRsvYh2bzNFadRXrxdApZQUx2aUD+IpNGGZHP8trVDGv4YKm0+ph/p+C+
VS1rUAymLYQ=
=ysLs
-----END PGP SIGNATURE-----