The Sendmail service must not have the wizard backdoor active.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-4694	GEN004700	SV-35093r1_rule	ECSC-1	Low

Description
Very old installations of the Sendmail mailing system contained a feature whereby a remote user connecting to the SMTP port can enter the WIZ command and be given an interactive shell with root privileges.

STIG	Date
HP-UX 11.31 Security Technical Implementation Guide	2018-09-14

Details

Check Text ( C-36577r1_chk )
Check the /etc/mail/sendmail.cf configuration file for "wiz" configuration. # cat /etc/mail/sendmail.cf |tr '\011' ' ' | tr -s ' ' | sed -e 's/^[ \t]*//' | grep -v "^#" |\ grep -i wiz If an entry is found for wiz, this is a finding.

Fix Text (F-31945r1_fix)
If the WIZ command is enabled on Sendmail, it should be disabled by adding this line to the sendmail.cf configuration file (note that it must be typed in uppercase): OW* For the change to take effect, kill the Sendmail process, refreeze the sendmail.cf file, and restart the Sendmail process.