Red Hat, Inc. Information for VU#834865

• Vendor Information Help Date Notified: 08 Mar 2006
• Statement Date: 21 Mar 2006
• Date Updated: 21 Mar 2006

Status

Affected

Vendor Statement

Red Hat distributes Sendmail packages in all Red Hat Enterprise Linux releases. Red Hat was provided with a patch for this issue in advance by the Sendmail security team, but we have not been able to verify if this issue is actually exploitable on Red Hat Enterprise Linux systems.

By default on Red Hat Enterprise Linux, Sendmail is configured to only accept connections locally. Only users who had configured Sendmail to listen to remote hosts and opened their firewall would have been potentially vulnerable to this issue.

Updates are available for Red Hat Enterprise Linux to correct this flaw. Updated Sendmail packages along with our advisory are available at the URL below and by using the Red Hat Network 'up2date' tool.

Red Hat Enterprise Linux 3 and 4:

http://rhn.redhat.com/errata/RHSA-2006-0264.html

Red Hat Enterprise Linux 2.1:

http://rhn.redhat.com/errata/RHSA-2006-0265.html

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

None

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.