Vulnerability in Diffie-Hellman ciphers affects sendmail on VIOS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Mon Mar 29 15:54:57 CDT 2010

The most recent version of this document is available here:

http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory.asc

                       VULNERABILITY SUMMARY

VULNERABILITY: AIX sendmail SSL certificate vulnerability

PLATFORMS: AIX 5.3, 6.1
VIOS 1.5, 2.1

SOLUTION: Apply the fix or workaround as described below.

THREAT: A man-in-the-middle attacker may be able to
spoof arbitrary SSL SMTP servers

CERT VU Number: n/a
CVE Number: CVE-2009-4565

Reboot required? NO
Workarounds? NO
Protected by FPM? NO
Protected by SED? NO

                       DETAILED INFORMATION

I. DESCRIPTION (from CVE)

"sendmail before 8.14.4 does not properly handle a '\0' character
in a Common Name (CN) field of an X.509 certificate, which (1)
allows man-in-the-middle attackers to spoof arbitrary SSL-based
SMTP servers via a crafted server certificate issued by a
legitimate Certification Authority, and (2) allows remote
attackers to bypass intended access restrictions via a crafted
client certificate issued by a legitimate Certification Authority,
a related issue to CVE-2009-2408."

II. PLATFORM VULNERABILITY ASSESSMENT

Note: To use the following commands on VIOS you must first
execute:

oem_setup_env

To determine if your system is vulnerable, execute the following
command:

lslpp -L bos.net.tcp.client

The following fileset levels are vulnerable:

AIX Fileset        Lower Level     Upper Level
------------------------------------------------
bos.net.tcp.client 5.3.8.0         5.3.8.11
bos.net.tcp.client 5.3.9.0         5.3.9.7
bos.net.tcp.client 5.3.10.0        5.3.10.2
bos.net.tcp.client 5.3.11.0        5.3.11.2
bos.net.tcp.client 6.1.1.0         6.1.1.7
bos.net.tcp.client 6.1.2.0         6.1.2.6
bos.net.tcp.client 6.1.3.0         6.1.3.3
bos.net.tcp.client 6.1.4.0         6.1.4.3

III. SOLUTION

A. FIXES

    Fixes are now available.  The fixes are interim fixes.  The
    fixes can be downloaded from:

    http://aix.software.ibm.com/aix/efixes/security/sendmail_fix.tar

    The links above are to a tar file containing this signed
    advisory, fix packages, and PGP signatures for each package.

    AIX Level    VIOS Level       Fix
    ------------------------------------------------------
    5.3.8        1.5.2            IZ72834_08.100329.epkg.Z
    5.3.9                         IZ72835_09.100329.epkg.Z
    5.3.10                        IZ72836_10.100329.epkg.Z
    5.3.11                        IZ72837_11.100329.epkg.Z
    6.1.1                         IZ72528_01.100329.epkg.Z
    6.1.2        2.1.0            IZ72515_02.100329.epkg.Z
    6.1.3        2.1.1            IZ72510_03.100329.epkg.Z
    6.1.4        2.1.2            IZ70637_04.100329.epkg.Z

    To extract the fixes from the tar file:

    tar xvf sendmail_fix.tar
    cd sendmail_fix

    Verify you have retrieved the fixes intact:

    The checksums below were generated using the "csum -h SHA1"
    (sha1sum) commands and are as follows:

    csum -h SHA1 (sha1sum)                    filename
    ------------------------------------------------------------------
    5643989ef10e97eba58fb49c1399dc35fd4efe59  IZ70637_04.100329.epkg.Z
    9c3341316809bb06962840aa0f18157878784ec7  IZ72510_03.100329.epkg.Z
    261613c73338faeaffc69b5c6314b737ac6c52a1  IZ72515_02.100329.epkg.Z
    8b529961f722c4df077ba00a50d8daf293d64d71  IZ72528_01.100329.epkg.Z
    4a21abf1366ed3d0052c0fcf064ff01be546447a  IZ72834_08.100329.epkg.Z
    b30e05ec7a60e89ccbca0bad0b9092f38795ec98  IZ72835_09.100329.epkg.Z
    7821837e1954ebac5d83485348984033c93c8667  IZ72836_10.100329.epkg.Z
    3bfabc5510c3d55b9c599d8bae17b11e4967bf64  IZ72837_11.100329.epkg.Z

    To verify the sums, use the text of this advisory as input to
    csum or sha1sum. For example:

    csum -h SHA1 -i sendmail_advisory.asc
    sha1sum -c sendmail_advisory.asc

    These sums should match exactly. The PGP signatures in the tar
    file and on this advisory can also be used to verify the
    integrity of the fixes.  If the sums or signatures cannot be
    confirmed, contact IBM AIX Security and describe the
    discrepancy at the following addresses:

        [email protected]
        [email protected] (Andy Hazlewood)

 B. FIX INSTALLATION

    IMPORTANT: If possible, it is recommended that a mksysb backup
    of the system be created.  Verify it is both bootable and
    readable before proceeding.

    Fix management documentation can be found at:

    http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html

    To preview fix installation:

    emgr -e fix_name -p         # where fix_name is the name of the  
                                # fix being previewed.

    To install fix package:

    emgr -e fix_name -X         # where fix_name is the name of the  
                                # fix being installed.

    IMPORTANT: The fix will not take affect until any running sendmail
    servers have been stopped and restarted with the following
    commands:

    stopsrc -s sendmail
    startsrc -s'sendmail' -a'-bd -q30m' 

C. APARS

    IBM has assigned the following APARs to this problem:

    AIX Level           APAR number        Service pack date
    --------------------------------------------------------
    5.3.8               IZ72834            5/19/10 sp10
    5.3.9               IZ72835            5/19/10 sp7
    5.3.10              IZ72836            5/19/10 sp4
    5.3.11              IZ72837            5/19/10 sp4
    6.1.1               IZ72528            4/21/10 sp8
    6.1.2               IZ72515            4/21/10 sp7
    6.1.3               IZ72510            4/21/10 sp4
    6.1.4               IZ70637            4/21/10 sp4

    Subscribe to the APARs here:

    http://www.ibm.com/support/docview.wss?uid=isg1IZ72834
    http://www.ibm.com/support/docview.wss?uid=isg1IZ72835
    http://www.ibm.com/support/docview.wss?uid=isg1IZ72836
    http://www.ibm.com/support/docview.wss?uid=isg1IZ72837
    http://www.ibm.com/support/docview.wss?uid=isg1IZ72528
    http://www.ibm.com/support/docview.wss?uid=isg1IZ72515
    http://www.ibm.com/support/docview.wss?uid=isg1IZ72510
    http://www.ibm.com/support/docview.wss?uid=isg1IZ70637

    By subscribing, you will receive periodic email alerting you
    to the status of the APAR, and a link to download the service
    pack when it becomes available.

IV. WORKAROUND

None.

VI. CONTACT INFORMATION

If you would like to receive AIX Security Advisories via email,
please visit:

    http://www.ibm.com/systems/support

and click on the "My notifications" link.

To view previously issued advisories, please visit:

    http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd

Comments regarding the content of this announcement can be
directed to:

    [email protected]
    [email protected] (Andy Hazlewood)

To obtain the PGP public key that can be used to communicate
securely with the AIX Security Team you can either:

    A. Send an email with "get key" in the subject line to:

        [email protected]

    B. Download the key from our web page:

http://www.ibm.com/systems/resources/systems_p_os_aix_security_pgpkey.txt

    C. Download the key from a PGP Public Key Server. The key ID is:

        0xF3807ECD

Please contact your local IBM AIX support center for any
assistance.

eServer is a trademark of International Business Machines
Corporation.  IBM, AIX and pSeries are registered trademarks of
International Business Machines Corporation.  All other trademarks
are property of their respective holders.

VII. ACKNOWLEDGMENTS

This vulnerability was reported by sendmail.org for an issue found
by Moxie Marlinspike.  This advisory was written by Andy Hazlewood
([email protected]).

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (AIX)

iD8DBQFLshIJxvGNyvOAfs0RAqrCAKCE8qpzbW+cZ87GgA6pMm8QCTY7XwCfbg8N
mBR8IALfZXJqaL2QTNm741c=
=XgvM
-----END PGP SIGNATURE-----