Re: Major remote root vunerability found in sendmail

From: H D Moore (hdmat_private)
Date: Mon Mar 03 2003 - 11:07:37 PST

Next message: Erik Parker: "Re: Major remote root vunerability found in sendmail"

Previous message: Michael Scheidell: "Major remote root vunerability found in sendmail"
In reply to: Michael Scheidell: "Major remote root vunerability found in sendmail"
Next in thread: Erik Parker: "Re: Major remote root vunerability found in sendmail"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

That work work for all of them, one of our guys is working on a nice regex for them now, will post when its done. 
Below are some of the banners we have run into before.

MetaInfo Sendmail 2.5 Build 2630 (Berkeley 8.8.6)/8.8.4
Sendmail  Mon, 29 Jan 2001 23:56:28 -0700
Sendmail 8.10.1/8.10.1
Sendmail 8.10.1/8.9.0
Sendmail 8.10.2+Sun/8.10.2
Sendmail 8.10.2/8.10.2
Sendmail 8.10.2/8.10.2 Mon, 29 Jan 2001 16:50:20 -0700
Sendmail 8.10.2/8.10.2 Mon, 29 Jan 2001 16:51:13 -0700
Sendmail 8.11.0/8.11.0
Sendmail 8.11.0/8.11.0 Mon, 15 Jan 2001 21:50:11 +0600
Sendmail 8.11.0/8.11.0 Mon, 15 Jan 2001 21:50:12 +0600
Sendmail 8.11.0/8.11.0 Mon, 15 Jan 2001 22:54:28 -0500
Sendmail 8.11.0/8.11.0 Mon, 15 Jan 2001 22:54:29 -0500
Sendmail 8.11.0/8.11.0 Wed, 17 Jan 2001 09:36:00 +0600
Sendmail 8.11.0/8.11.0 Wed, 17 Jan 2001 09:36:02 +0600
Sendmail 8.11.0/8.11.0 Wed, 17 Jan 2001 10:40:57 -0500
Sendmail 8.11.0/8.11.0 Wed, 17 Jan 2001 10:40:59 -0500
Sendmail 8.11.0/8.11.0 Wed, 17 Jan 2001 14:19:45 -0500
Sendmail 8.11.0/8.11.0 Wed, 17 Jan 2001 14:19:46 -0500
Sendmail 8.11.1/8.11.1
Sendmail 8.11.1/8.11.1 Mon,
Sendmail 8.11.4/8.11.4
Sendmail 8.11.6 ready at Thu, 8 Aug 2002 16:10:15 -0600 (MDT)
Sendmail 8.11.6 ready at Thu, 8 Aug 2002 16:21:08 -0600 (MDT)
Sendmail 8.11.6 ready at Tue, 9 Jul 2002 10:07:30 -0400 (EDT)
Sendmail 8.11.6+Sun/8.11.6
Sendmail 8.11.6/8.11.0
Sendmail 8.11.6/8.11.6
Sendmail 8.12.0.Beta7/8.12.0.Beta7
Sendmail 8.12.2+Sun/8.12.2
Sendmail 8.12.3/8.12.3
Sendmail 8.12.5/8.12.5/Debian-1
Sendmail 8.12.6/8.11.6
Sendmail 8.12.6/8.12.5
Sendmail 8.12.6/8.12.6
Sendmail 8.12.7/8.11.6
Sendmail 8.7.1/8.7.1
Sendmail 8.7.1/8.7.1 Mon, 13 Aug
Sendmail 8.7.1/8.7.1 Tue, 15 Jan
Sendmail 8.7.1/8.7.1 Tue, 18 Dec
Sendmail 8.7.1/8.7.1 Tue, 18 Sep
Sendmail 8.7.1/8.7.1 Wed, 24 Oct
Sendmail 8.7.6/8.7.1
Sendmail 8.8.6
Sendmail 8.8.6
Sendmail 8.8.6 (PHNE_14041)/8.7.1
Sendmail 8.8.6 (PHNE_14041)/8.8.6
Sendmail 8.8.6 (PHNE_15509)/8.7.1
Sendmail 8.8.6 (PHNE_15509)/8.8.6
Sendmail 8.8.6 (PHNE_17190)/8.7.1
Sendmail 8.8.6 (PHNE_17190)/8.8.6
Sendmail 8.8.8 (1.1.22.3/12Apr00-0403PM) Mon, 2 Oct 2000 15:52:56 -0400 (EDT)
Sendmail 8.8.8 (1.1.22.3/12Apr00-0403PM) Thu, 12 Dec 2002 15:29:27 -0500 (EST)
Sendmail 8.8.8 (1.1.22.3/12Apr00-0403PM) Thu, 12 Dec 2002 15:30:32 -0500 (EST)
Sendmail 8.8.8 (1.1.22.3/12Apr00-0403PM) Thu, 16 Jan 2003 15:47:43 -0500 (EST)
Sendmail 8.8.8 (1.1.22.3/12Apr00-0403PM) Thu, 16 Jan 2003 15:48:13 -0500 (EST)
Sendmail 8.8.8 (1.1.22.3/12Apr00-0403PM) Thu, 20 Feb 2003 11:27:10 -0500 (EST)
Sendmail 8.8.8 (1.1.22.3/12Apr00-0403PM) Thu, 20 Feb 2003 11:27:22 -0500 (EST)
Sendmail 8.8.8 (1.1.22.3/12Apr00-0403PM) Thu, 3 Oct 2002 18:07:56 -0400 (EDT)
Sendmail 8.8.8 (1.1.22.3/12Apr00-0403PM) Thu, 3 Oct 2002 18:10:56 -0400 (EDT)
Sendmail 8.8.8 (1.1.22.3/12Apr00-0403PM) Tue, 5 Nov 2002 14:30:49 -0500 (EST)
Sendmail 8.8.8 (1.1.22.3/12Apr00-0403PM) Tue, 5 Nov 2002 14:33:49 -0500 (EST)
Sendmail 8.9.1b+Sun/8.9.1
Sendmail 8.9.3
Sendmail 8.9.3 (PHNE_18546)/8.7.1
Sendmail 8.9.3 (PHNE_24419)/8.9.3
Sendmail 8.9.3 (PHNE_25183)/8.8.6
Sendmail 8.9.3+Sun/8.9.1
Sendmail 8.9.3+Sun/8.9.3
Sendmail 8.9.3/8.7.1
Sendmail 8.9.3/8.8.7
Sendmail 8.9.3/8.8.7  Wed, 21 Jun 2000 14:05:23 -0500
Sendmail 8.9.3/8.8.7  Wed, 21 Jun 2000 15:55:19 -0500
Sendmail 8.9.3/8.8.7 Fri, 9 Feb 2001 10:49:24 -0600
Sendmail 8.9.3/8.8.7 Mon, 5 Feb 2001 14:46:34 -0600
Sendmail 8.9.3/8.8.7 Tue, 20 Feb 2001 14:07:46 -0600
Sendmail 8.9.3/8.8.7 Tue, 20 Feb 2001 14:07:47 -0600
Sendmail 8.9.3/8.9.3
Sendmail 8.9.3/8.9.3  Mon, 19 Jun 2000 08:05:14 -0500
Sendmail 8.9.3/8.9.3  Mon, 19 Jun 2000 13:17:08 -0500
Sendmail 8.9.3/8.9.3  Mon, 19 Jun 2000 13:19:34 -0500
Sendmail 8.9.3/8.9.3  Wed, 14 Jun 2000 04:32:32 -0500
Sendmail 8.9.3/8.9.3  Wed, 14 Jun 2000 09:06:48 -0500
Sendmail 8.9.3/8.9.3  Wed, 14 Jun 2000 09:26:34 -0500
Sendmail 8.9.3/8.9.3 Fri,
Sendmail 8.9.3/8.9.3 Mon, 29 Jan 2001 17:36:29 -0700
Sendmail 8.9.3/8.9.3 Mon, 29 Jan 2001 23:57:33 -0700
Sendmail 8.9.3/8.9.3 Mon, 29 Jan 2001 23:57:34 -0700
Sendmail 8.9.3/8.9.3 Tue, 7 Nov 2000 05:47:12 -0800 (PST)
Sendmail 8.9.3/8.9.3 Tue, 7 Nov 2000 05:49:46 -0800 (PST)
Sendmail 8.9.3/8.9.3 Wed,
Sendmail 8.9.3/8.9.3 Wed, 2 May 2001 14:51:46 -0500
Sendmail 8.9.3/8.9.3/Debian
Sendmail 8.9.3/SCO5 ready at Thu, 5 Sep 2002 09:59:38 -0500 (CDT)
Sendmail 8.9.3/SCO5 ready at Thu, 5 Sep 2002 09:59:41 -0500 (CDT)
Sendmail 8.9.3/UW7.1.1 ready at Mon, 24 Feb 2003 13:53:49 -0500 (EST)
Sendmail 8.9.3/UW7.1.1 ready at Mon, 24 Feb 2003 13:56:34 -0500 (EST)
Sendmail AIX4.2/UCB 8.7
Sendmail AIX4.2/UCB 8.7 Fri, 25 May 2001 10:36:41 -0600 (CST)
Sendmail AIX4.2/UCB 8.7 Thu, 22 Feb 2001 12:07:06 -0600 (CST)
Sendmail AIX4.2/UCB 8.7 Wed, 21 Feb 2001 00:53:19 -0600 (CST)
Sendmail AIX4.2/UCB 8.7 Wed, 26
Sendmail AIX4.3/8.9.3
Sendmail AIX4.3/8.9.3/8.9.3
Sendmail AIX4.3/8.9.3/8.9.3 Sat, 9
Sendmail AIX4.3/8.9.3/8.9.3 Wed, 2
Sendmail AIX4.3/UCB 8.8.8/8.8.8
Sendmail Switch-2.1.1/Switch-2.1.1
Sendmail for NT Build 101
Sendmail for NT Build 101
Sendmail for NT Build 101 8.9.3/NT-8.9.3

On Monday 03 March 2003 12:21 pm, Michael Scheidell wrote:
> Preliminary plugin to detect sendmail versions prior to 8.12.8
>
> Note: the advisory from iss states that sendmail vers 5.79 to 8.12.7
> are vulnerable, but this plugin checks for sendmail version 5.* to
> 8.12.7
>
> This is a banner check only, no exploit has been attacked to this
> plugin yet, but updates may come as more information is available.

Next message: Erik Parker: "Re: Major remote root vunerability found in sendmail"
Previous message: Michael Scheidell: "Major remote root vunerability found in sendmail"
In reply to: Michael Scheidell: "Major remote root vunerability found in sendmail"
Next in thread: Erik Parker: "Re: Major remote root vunerability found in sendmail"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Mar 03 2003 - 11:08:01 PST