Sendmail.com - Product Security — Product Security Advisory SA-200607-02

If the attacker has control over their reverse DNS records, the vulnerability is easy to exploit. The attacker has to falsify the PTR record in DNS, such that it claims the host from which the attack is being launched has a name that otherwise wouldn't be filtered.

Has anyone been impacted by this?

To Sendmail's knowledge there are no known exploits.

What should a user look for to know if they have been impacted?

The user will know that they have been impacted if they are receiving messages that should have been filtered based on connection information.

What would happen if someone does exploit this?

Any hostname-based policy would be bypassed.

Are sendmail MTAs behind my firewall vulnerable?

A sendmail MTA receiving the initial connection from the attacker is vulnerable. Therefore, a sendmail MTA behind a firewall is vulnerable when the firewall is not an SMTP proxy.

Is this a recently introduced problem, or has it been present for some time?

This problem has been in the Sendmail Switch product since version 1.0.

What are you doing to notify affected users?

Sendmail has notified supported and unsupported customers in advance of the public announcement of this issue and provided patches to those customers.

What should users do until they can install the patches?

Sendmail suggests converting hostname-based filtering policy to IP address-based policy where possible until patches are installed.

What should the users do to request the patches?

Sendmail has notified our commercial customers about the patches and provided the information on how to download and obtain these patches.

What about 3rd party vendors using the sendmail MTA or who use the milter API in the sendmail MTA?

Those vendors should update their distribution of the sendmail MTA or perform hostname validation within their code.

How important is this issue, how quickly should I plan to upgrade?

Sendmail's threat assessment of this issue is critical. This vulnerability has serious impact on the effectiveness of security products plugged into the MTA. A workaround or upgrade should be deployed as soon as possible.

What are my options?

Your options are:

1. Patch your system; or
2. Configure your filter to avoid the impacts.

See "What should users do until they can install the patches?" above for more information.

Will this issue shut down my server?

No, this vulnerability will not shut down your server, but it may interfere with effectiveness of email filters which filter based on hostnames.

Will this issue cause me to lose mail?

No, this vulnerability will not cause you to lose mail. However, you may accept mail which has bypassed filtering.

Is this issue related to the recent security vulnerability in certain versions of sendmail Mail Transfer Agent?

No, this vulnerability is not related to the recent Sendmail MTA security vulnerability. However, the Switch 3.1.10 and 3.2.3 releases include fixes for past vulnerabilities.

What are all the new changes included in the Switch for Windows 3.1.5, Switch 3.1.10, Switch 3.2.3, and Sentrion 1.5.4 patches?

Sendmail Switch 3.1.5, 3.1.10, 3.2.3, and Sentrion 1.5.4 contain changes to the sendmail MTA binary to resolve this vulnerability.

How can I verify this is a legitimate security advisory?

Customers can contact Sendmail Technical Support as listed on http://www.sendmail.com/support/contact/ to verify the authenticity of this advisory. The email notification sent to Sendmail customers is signed with PGP, using the Sendmail, Inc. Security Officer PGP key, available at: http://www.sendmail.com/security/security-officer.asc.

How was this issue discovered?

How difficult would it be for someone to exploit this vulnerability?