GEN004640 - The SMTP service must not have a uudecode alias active - '/usr/lib/aliases decode alias does not exist'

Information

A common configuration for older Mail Transfer Agents (MTAs) includes an alias for the decode user. All mail sent to this user is sent to the uudecode program, which automatically converts and stores files. By sending mail to decode or uudecode aliases present on some systems, a remote attacker may be able to create or overwrite files on the remote host. This could possibly be used to gain remote access.

Solution

Disable mail aliases for decode and uudecode. If the /etc/aliases or /usr/lib/aliases (mail alias) file contains entries for these programs, remove them or disable them by placing # at the beginning of the line, and then executing the 'newaliases' command. For more information on mail aliases, refer to the man page for aliases. Disabled aliases would be similar to the examples below:
# decode: |/usr/bin/uudecode
# uudecode: |/usr/bin/uuencode -d

See Also

http://iasecontent.disa.mil/stigs/zip/U_STIG_Library_2015_07.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-2d., CAT|I, CCI|CCI-001230, Rule-ID|SV-4691r2_rule, STIG-ID|GEN004640, Vuln-ID|V-4691

Plugin: Unix

Control ID: bf1abe9bae61f168d387f8776569af9f1c6d4d616a34ade9135aca98e283e15c