Skip to Content.
Sympa Menu

sm-grimoire - [SM-Grimoire] Another sendmail hole

sm-grimoire AT lists.ibiblio.org

Subject: Discussion of Spells and Grimoire items

List archive

Chronological Thread  
  • From: Pierre Abbat <phma AT webjockey.net>
  • To: sm-grimoire AT lists.ibiblio.org
  • Subject: [SM-Grimoire] Another sendmail hole
  • Date: Sat, 29 Mar 2003 18:23:53 -0500

I just looked at Bugtraq and there's a new sendmail out. Michal Zalewski
found
a hole in sendmail in which a character 0xff in the right place, sent to a
sendmail compiled with signed characters, can be misinterpreted as a flag
that indicates no character. The new version is 8.12.9.

phma
--
.i toljundi do .ibabo mi'afra tu'a do
.ibabo damba do .ibabo do jinga
.icu'u la ma'atman.
>From seth AT tautology.org Sat Mar 29 20:53:27 2003
Return-Path: <seth AT tautology.org>
Delivered-To: sm-grimoire AT lists.ibiblio.org
Received: from tautology.org
(evrtwa1-ar13-4-33-070-190.evrtwa1.dsl-verizon.net [4.33.70.190])
by happyhouse.metalab.unc.edu (Postfix) with ESMTP id 70D4220017
for <sm-grimoire AT lists.ibiblio.org>;
Sat, 29 Mar 2003 20:53:26 -0500 (EST)
Received: from tautology.org (tautology.org [127.0.0.1])
by tautology.org (8.12.9/8.12.9) with ESMTP id h2U1rPKK015571;
Sat, 29 Mar 2003 17:53:25 -0800 (PST)
(envelope-from seth AT tautology.org)
Received: from localhost (seth@localhost)
by tautology.org (8.12.9/8.12.9/Submit) with ESMTP id h2U1rPm3015568;
Sat, 29 Mar 2003 17:53:25 -0800 (PST)
Date: Sat, 29 Mar 2003 17:53:23 -0800 (PST)
From: Seth Woolley <seth AT tautology.org>
To: Pierre Abbat <phma AT webjockey.net>
Subject: Re: [SM-Grimoire] Another sendmail hole (fixed)
In-Reply-To: <200303291823.53817.phma AT webjockey.net>
Message-ID: <20030329173943.R15328-100000 AT tautology.org>
References: <200303291823.53817.phma AT webjockey.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
cc: sm-grimoire AT lists.ibiblio.org
X-BeenThere: sm-grimoire AT lists.ibiblio.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussion of Spells and Grimoire items
<sm-grimoire.lists.ibiblio.org>
List-Unsubscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-grimoire>,
<mailto:sm-grimoire-request AT lists.ibiblio.org?subject=unsubscribe>
List-Archive: <https://lists.ibiblio.org/sympa/arc/sm-grimoire>
List-Post: <mailto:sm-grimoire AT lists.ibiblio.org>
List-Help: <mailto:sympa AT lists.ibiblio.org?subject=HELP>
List-Subscribe: <http://lists.ibiblio.org/mailman/listinfo/sm-grimoire>,
<mailto:sm-grimoire-request AT lists.ibiblio.org?subject=subscribe>
X-List-Received-Date: Sun, 30 Mar 2003 01:53:28 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

see:
http://news.sourcemage.org/

Fixed it already, thanks for the note anyways, though. ;)

BTW, if you want to keep track of security, the policy that is forming
is that all security announcements go to news.sourcemage.org webpage
(which feeds to the www.sourcemage.org front page) and is tracked with the
sm-security email list, the "owner" of all the security-relate bugs.

We have a couple people able to make immediate security fixes up to test
and stable. Mat (M_L, ml) and I (Seth, swoolley). I think you must have
sent this email while we were in the chat room working on testing and gpg
checking the new tarballs ;)

Feel like joining the security team?

Seth
Sec. Team Lead

On Sat, 29 Mar 2003, Pierre Abbat wrote:

> I just looked at Bugtraq and there's a new sendmail out. Michal Zalewski
> found
> a hole in sendmail in which a character 0xff in the right place, sent to a
> sendmail compiled with signed characters, can be misinterpreted as a flag
> that indicates no character. The new version is 8.12.9.
>
> phma
> --
> .i toljundi do .ibabo mi'afra tu'a do
> .ibabo damba do .ibabo do jinga
> .icu'u la ma'atman.
> _______________________________________________
> SM-Grimoire mailing list
> SM-Grimoire AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-grimoire
>

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+hk4V7fQ833vqzH0RAnBZAJ9LALD/V/anmXOc0cAhm1sUHNLaawCfblaO
fJO+jCdxcuaWITENhqiGdEQ=
=EADr
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page