The SMTP service must not have a uudecode alias active.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-4691	GEN004640	SV-35071r1_rule	ECSC-1	High

Description
A common configuration for older mail transfer agents (MTAs) is to include an alias for the decode user. All mail sent to this user is sent to the uudecode program, which automatically converts and stores files. By sending mail to the decode or the uudecode aliases present on some systems, a remote attacker may be able to create or overwrite files on the remote host. This could possibly be used to gain remote access.

Description

A common configuration for older mail transfer agents (MTAs) is to include an alias for the decode user. All mail sent to this user is sent to the uudecode program, which automatically converts and stores files. By sending mail to the decode or the uudecode aliases present on some systems, a remote attacker may be able to create or overwrite files on the remote host. This could possibly be used to gain remote access.

STIG	Date
HP-UX 11.31 Security Technical Implementation Guide	2018-03-01

Details

Check Text ( C-36574r1_chk )
Check the SMTP service for an active decode command. # telnet localhost 25 decode If the command does not return a 500 error code of command unrecognized, this is a finding.

Fix Text (F-31942r1_fix)
Disable mail aliases for decode and uudecode. If the /etc/mail/aliases (mail alias) file contains entries for these programs, remove them or disable them by placing # at the beginning of the line, and then executing the newaliases command. For more information on mail aliases, refer to the man page for aliases. Disabled aliases would be similar to these (commented) file entry examples: # decode: \|/usr/bin/uudecode # uudecode: \|/usr/bin/uuencode -d

Fix Text (F-31942r1_fix)

Disable mail aliases for decode and uudecode. If the /etc/mail/aliases (mail alias) file contains entries for these programs, remove them or disable them by placing # at the beginning of the line, and then executing the newaliases command. For more information on mail aliases, refer to the man page for aliases. Disabled aliases would be similar to these (commented) file entry examples:
# decode: |/usr/bin/uudecode
# uudecode: |/usr/bin/uuencode -d