Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Sendmail exploit affects SMGL

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Woolley <seth AT tautology.org>
  • To: Source Mage - Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] Sendmail exploit affects SMGL
  • Date: Mon, 3 Mar 2003 14:23:48 -0800 (PST)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

devel and test are updated in perforce. stable should be updated soon.
see:

http://bugs.sourcemage.org/show_bug.cgi?id=2713

and the following patch that works on devel, test, and stable:

diff -Nuar ../../../devel/mail/sendmail/DETAILS ./DETAILS
- --- ../../../devel/mail/sendmail/DETAILS 2003-02-06
11:09:14.000000000 +0000
+++ ./DETAILS 2003-03-03 20:32:52.000000000 +0000
@@ -1,9 +1,9 @@
SPELL=sendmail
- - VERSION=8.12.7
+ VERSION=8.12.8
SOURCE=$SPELL.$VERSION.tar.gz
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
SOURCE_URL[0]=ftp://ftp.sendmail.org/pub/$SPELL/$SOURCE
- - MD5[0]=64a77e0a689e4707e48e0275dc06a693
+ MD5[0]=5022021ed6c9b60c7f2ca53fc875f5bc
SOURCE_URL[1]=http://www.sendmail.org/ftp/$SOURCE
MD5[1]=${MD5[0]}
SOURCE_URL[2]=ftp://ftp.ciril.fr/pub/messagerie/sendmail/$SOURCE
@@ -43,7 +43,7 @@

SOURCE_URL[19]=ftp://download.sourcemage.org/pub/linux/distributions/sourcemage/mirror/$SOURCE
MD5[19]=${MD5[0]}
ENTERED=20020820
- - UPDATED=20020820
+ UPDATED=20030303
LICENSE=SENDMAIL
WEB_SITE=http://www.sendmail.org
MAINTAINER=m.l AT compaqnet.fr

Compiles fine here...

Seth

On Mon, 3 Mar 2003, Eric Sandall wrote:

> http://www.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21950
>
> Sendmail 8.12.8 has been released to fix this, or a patch for prior
> versions can be downloaded (we have 8.12.7 in devel)
>
> Excerpt from alert:
>
> ------
> Sendmail urges all users to either upgrade to Sendmail 8.12.8 or apply a
> patch
> for 8.12.x (or for older versions). Updates can be downloaded from
> ftp.sendmail.org or any of its mirrors (try a mirror near to you first), see
> http://www.sendmail.org/ for details. Remember to check the PGP signatures
> of
> patches or releases obtained. For those not running the open source version,
> check with your vendor for a patch. Sendmail, Inc., the commercial provider
> of
> the sendmail MTA, is providing a binary patch for their commercial
> customers.
> The patch can be downloaded from Sendmail's Web site at:
> http://www.sendmail.com/
>
> Sendmail versions that are patched will record the following log entry when
> exploitation is attempted: "Dropped invalid comments from header address".
> ------
>
> -One of Four
> a.k.a. sandalle
>
> --
> PGP Key 0x5C8D199A5A317214
> http://search.keyserver.net:11371/pks/lookup?op=get&search=0x5A317214
>
> Eric Sandall | Source Mage GNU/Linux Developer
> eric AT sandall.us | http://www.sourcemage.org/
> http://www.sandall.us/~sandalle/ | SysAdmin @ Inst. Shock Physics @ WSU
> http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
>
>
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+Y9X37fQ833vqzH0RApu9AJ9mc5dbChIACGnD8pSjlUmrmeBDTACfab9y
QfFnCE0ZsPKJxVU0T5I49ME=
=f6eV
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page