[bglug] [security@slackware.com: [slackware-security] Sendmail buffer overflow fixed]
k|b|s
bglug@lists.linux.it
Tue, 4 Mar 2003 11:29:18 +0100
--rwEMma7ioTxnRzrJ
Content-Type: text/plain; charset=iso-8859-1; format=flowed
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Se qualche utente Slack usa sendmail, ecco pronta la patch per il baco
uscito ieri.
Ciao.
--=20
La vita *=E8* un film. Non tutti per=F2 sono registi.
* k|b|s * mailto `echo ti.gulgb@sbk|'rev'`
--rwEMma7ioTxnRzrJ
Content-Type: message/rfc822
Content-Disposition: inline
Return-Path: <owner-slackware-security@slackware.com>
Delivered-To: ciosul@inwind.it
Received: from smtp7.libero.it (193.70.192.90) by ims10a.libero.it (6.5.025)
id 3E388258009E78CA for ciosul@inwind.it; Tue, 4 Mar 2003 11:25:28 +0100
Received: from blackbox.blacknova.net (216.220.40.202) by smtp7.libero.it (6.7.015)
id 3E59CF4201126A49 for ciosul@inwind.it; Tue, 4 Mar 2003 11:25:28 +0100
Received: from bob.slackware.com (slackware.com [64.57.102.34])
by blackbox.blacknova.net (8.11.6/linuxconf) with ESMTP id h24AFuY26243
for <kbs@linux.ca>; Tue, 4 Mar 2003 05:16:01 -0500
Received: (from daemon@localhost)
by bob.slackware.com (8.11.6/8.11.6) id h23MOhp13226
for slackware-security-outgoing; Mon, 3 Mar 2003 14:24:43 -0800
Received: from localhost (security@localhost)
by bob.slackware.com (8.11.6/8.11.6) with ESMTP id h23MOhm13223
for <slackware-security@slackware.com>; Mon, 3 Mar 2003 14:24:43 -0800
Date: Mon, 3 Mar 2003 14:24:43 -0800 (PST)
From: Slackware Security Team <security@slackware.com>
To: slackware-security@slackware.com
Subject: [slackware-security] Sendmail buffer overflow fixed
Message-ID: <Pine.LNX.4.21.0303031424220.13214-100000@bob.slackware.com>
Sender: owner-slackware-security@slackware.com
Precedence: bulk
Reply-To: Slackware Security Team <security@slackware.com>
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=iso-8859-15
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[slackware-security] Sendmail buffer overflow fixed
The sendmail packages in Slackware 8.1 and -current have been patched to fix
a security problem. All sites running sendmail should upgrade.
More information on the problem can be found here:
http://www.sendmail.org/8.12.8.html
Here are the details from the Slackware 8.1 ChangeLog:
+--------------------------+
Mon Mar 3 10:29:01 PST 2003
patches/packages/sendmail-8.12.8-i386-1.tgz: Upgraded to sendmail-8.12.8.
From sendmail's RELNOTES:
SECURITY: Fix a remote buffer overflow in header parsing by dropping sender
and recipient header comments if the comments are too long. Problem noted
by Mark Dowd of ISS X-Force.
(* Security fix *)
patches/packages/sendmail-cf-8.12.8-noarch-1.tgz: Updated config files for
sendmail-8.12.8.
+--------------------------+
WHERE TO FIND THE NEW PACKAGES:
+-----------------------------+
Updated packages for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/sendmail-8.12.8-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/sendmail-cf-8.12.8-noarch-1.tgz
Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/sendmail-8.12.8-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/sendmail-cf-8.12.8-noarch-1.tgz
MD5 SIGNATURES:
+-------------+
Here are the md5sums for the packages:
Slackware 8.1 packages:
c2c72b982d91d9ca0f59ab2afdf337f2 sendmail-8.12.8-i386-1.tgz
0b8e338169dca7487dd042ba070120d1 sendmail-cf-8.12.8-noarch-1.tgz
Slackware -current packages:
a9db559cd852164577f26efff1e9b36d sendmail-8.12.8-i386-1.tgz
0141c1f40e1efd148f9ccd1d5a09e7f0 sendmail-cf-8.12.8-noarch-1.tgz
INSTALLATION INSTRUCTIONS:
+------------------------+
As root, upgrade the sendmail package(s) with upgradepkg:
upgradepkg sendmail-*.tgz
Then, restart sendmail:
/etc/rc.d/rc.sendmail restart
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
+------------------------------------------------------------------------+
| HOW TO REMOVE YOURSELF FROM THIS MAILING LIST: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back. Follow the instructions to |
| complete the unsubscription. Do not reply to this message to |
| unsubscribe! |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE+Y7AXakRjwEAQIjMRAq4iAJwIucFzraCEl/TW5xNW3/A8OBCuuACfdnpB
KnimFQKeMEWk+HEClZ0iCXc=
=0WNi
-----END PGP SIGNATURE-----
--rwEMma7ioTxnRzrJ--