The SMTP service must not have a uudecode alias active.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-4691	GEN004640	SV-42312r1_rule	ECSC-1	High

Description
A common configuration for older Mail Transfer Agents (MTAs) includes an alias for the decode user. All mail sent to this user is sent to the uudecode program, which automatically converts and stores files. By sending mail to decode or uudecode aliases present on some systems, a remote attacker may be able to create or overwrite files on the remote host. This could possibly be used to gain remote access.

Description

A common configuration for older Mail Transfer Agents (MTAs) includes an alias for the decode user. All mail sent to this user is sent to the uudecode program, which automatically converts and stores files. By sending mail to decode or uudecode aliases present on some systems, a remote attacker may be able to create or overwrite files on the remote host. This could possibly be used to gain remote access.

STIG	Date
SOLARIS 10 X86 SECURITY TECHNICAL IMPLEMENTATION GUIDE	2018-04-10

Details

Check Text ( C-40642r1_chk )
Check the SMTP service for an active decode command. Procedure: # telnet localhost 25 decode If the command does not return a 500 error code of command unrecognized, this is a finding. If telnet is unavailable for testing, check for the existence of the decode and uudecode aliases in the sendmail aliases file. Find the active sendmail aliases file. # grep AliasFile /etc/mail/sendmail.cf (The aliases file is usually at /etc/mail/aliases) Look for decode aliases in the aliases file. # grep decode /etc/mail/aliases If there is an uncommented decode or uudecode alias in the aliases file, this is a finding.

Check Text ( C-40642r1_chk )

Check the SMTP service for an active decode command.

Procedure:
# telnet localhost 25
decode

If the command does not return a 500 error code of command unrecognized, this is a finding.

If telnet is unavailable for testing, check for the existence of the decode and uudecode aliases in the sendmail aliases file.

Find the active sendmail aliases file.
# grep AliasFile /etc/mail/sendmail.cf
(The aliases file is usually at /etc/mail/aliases)
Look for decode aliases in the aliases file.
# grep decode /etc/mail/aliases

If there is an uncommented decode or uudecode alias in the aliases file, this is a finding.

Fix Text (F-35944r1_fix)
Comment out active decode and uudecode aliases in the aliases file. # vi /usr/mail/aliases Activate updated aliases file. # newaliases