Feeds

Sendmail vuln. Patch now

Clear and present danger

  • alert
  • submit to reddit

Top three mobile application threats

A serious flaw in Sendmail creates a way for attackers to take over email servers, security tools firm ISS warned yesterday.

Sendmail has a buffer overflow vulnerability, enabling attacks (using maliciously-constructed emails) of servers. Sendmail technology is the transport mechanism for most of the Net's email traffic.

ISS warns: "Vulnerable Sendmail servers will not be protected by legacy security devices such as firewalls and/or packet filters. This vulnerability is especially dangerous because the exploit can be delivered within an email message and the attacker doesn't need any specific knowledge of the target to launch a successful attack."

Sendmail versions from 5.79 to 8.12.7 are vulnerable.

According to security clearing house CERT, an exploit based on the vulnerability is yet to used by black hats. But that's no reason for complaceny - the flaw is serious and Sendmail is too tempting a target.

Sendmail Corporation advises sites upgrade to 8.12.8 if possible. Many vendors include vulnerable Sendmail servers as part of their software distributions, hence the need to patch Unix and Linux systems as well as dedicated mail servers. CERT's advisory provides links to available patches, which are mostly already available. ®

Related Stories

Sendmail Trojan looks familiar
Trojanized Sendmail distro circulated
FBI names 20 most unwanted security flaws

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
Oracle working on at least 13 Heartbleed fixes
Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.