## SMTP Banner Vulnerability

### Risk Factor: 4

### Machines Affected:

Any machine running Sendmail and allowing telnet connections to the SMTP port.

### Description:

A remote attacker can login to the SMTP port (usually port 25) on your machine and determine what version of Sendmail is running. This would help him/her determine if it is vulnerable, and which attacks can be used against your machine.

    Evil> telnet 666.666.666.666 25

    Connected to 666.666.666.666.
    Escape character is '^]'.
    220-satan.evil.net Sendmail 8.6.13/8.6.12 ready at Wed, 30 Feb 1996
    16:34:59 -0
    400
    220 ESMTP spoken here

We now know what Sendmail version is running, and if we have expliots we can attack. Not good.

### Consequences:

Helps to narrow down an attackers attempts at hacking your machine.

### Fix:

Update your Sendmail to the latest version.
Use a Sendmail front-end like smap & smapd, or upas in order to prevent an intruder from talking directly to Sendmail

Links for advisories/more info