The Sendmail service must not have the wizard backdoor active.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-4694	GEN004700	SV-4694r7_rule	ECSC-1	Low

Description
Very old installations of the Sendmail mailing system contained a feature whereby a remote user connecting to the SMTP port can enter the WIZ command and be given an interactive shell with root privileges.

STIG	Date
Draft AIX Security Technical Implementation Guide	2011-08-17

Details

Check Text ( C-706r3_chk )
Locate the sendmail.cf configuration file and check for wiz configuration. Procedure: # find / -name sendmail.cf –print # grep -v “^#” |grep -i wiz If an entry is found for wiz, this is a finding.

Fix Text (F-4622r2_fix)
If the WIZ command is enabled on Sendmail, it should be disabled by adding this line to the sendmail.cf configuration file (it must be typed in uppercase): OW* For the change to take effect, kill the Sendmail process, refreeze the sendmail.cf file, and restart the Sendmail process.