chain mail - have you installed your sendmail patches?

[David G. Hough at validgh]

Sun employees, at least, have been ordered to install a patched sendmail which
may prevent some of this kind of problem.

Everybody can consider whether their personal and root passwords might be
easily guessed.    Those in large organizations can undoubtedly look forward
to "suggestions" from the administration if their security is found wanting.

> From uunet!calvin.linfield.edu!luisc Mon Feb  7 16:26:06 1994
> Return-Path: <uunet!calvin.linfield.edu!luisc>
> Received: from uunet.UUCP by validgh.com (4.1/SMI-4.1)
> 	id AA02273; Mon, 7 Feb 94 16:26:05 PST
> Received: from calvin.linfield.edu by relay2.UU.NET with SMTP 
> 	(5.61/UUNET-internet-primary) id AAwcgt19417; Mon, 7 Feb 94 16:57:23 -0500
> Received: by calvin.linfield.edu (5.65/1.35)
> 	id AA11403; Mon, 7 Feb 94 13:57:05 -0800
> Message-Id: <9402072157.AA11403acalvin.linfield.edu>
> To: Bob Ezell <bobeacalvin.linfield.edu>
> Cc: Irving Wiswall <irvwacalvin.linfield.edu>, savelaatel.vtt.fi,
>         dghavalidgh.com, uunet!postmaster,
>         src4src!zaphodaimageek.york.cuny.edu, djwaBBN.COM, brackanm.picker.com,
>         philawubios.wustl.edu, nreadwinalondon.micrognosis.com,
>         dennisawestford.ccur.com, atoddpokasonny.medphys.ucl.ac.uk,
>         wexleraaecom.yu.edu
> Subject: Re: Chain letter
> Date: Mon, 07 Feb 94 13:57:04 PST
> From: (Craig Luis) <uunet!calvin.linfield.edu!luisc>
> Status: R
> 
> > Apparently, someone at 12:30am last night used my name and ID (somehow) to 
> > forward basically a chain letter to a bunch of people. I don't know who, but 
> I 
> > have apologized to the various boards which complained. So if you get 
> > some strange mail, ignore it, it's been taken care of.
> > 
> > I have also gone thru and changed  my password, if thats where the 
> > problem developed.
> > 
> > Bobby
> > -------------------------------------------------------------------------
> 
> I am forwarding this message to all who have responded only to postmaster
> and not to you.  Apparently we have a security hole (very possibly the
> sendmail bug that we now have a fix for from sequent), and I will check the
> logs to see if any light can be shed on the subject.  According to at least
> one response, this was posted to a number of USENET news group also.  I
> will be installing our patches tonight, and hopefully we will not have a
> repeat of this scenario.
> 
> Craig Luis, postmasteralinfield.edu