Title

The SMTP service must not have a uudecode alias active. (Cat I impact)

Discussion

A common configuration for older Mail Transfer Agents (MTAs) includes an alias for the decode user. All mail sent to this user is sent to the uudecode program, which automatically converts and stores files. By sending mail to decode or uudecode aliases present on some systems, a remote attacker may be able to create or overwrite files on the remote host. This could possibly be used to gain remote access.

Check Content

Check the SMTP service for an active decode command. Procedure: Look for decode aliases in the aliases file. # grep decode /etc/aliases If there is an uncommented decode or uudecode alias in the aliases file, this is a finding.

Fix Text

Comment out active decode and uudecode aliases in the aliases file.

Additional Identifiers

Rule ID:

Vulnerability ID: V-4691

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.