Your message dated Mon, 01 Nov 2010 23:32:28 +0000
with message-id <[email protected]>
and subject line Bug#542739: fixed in sendmail 8.14.4-1
has caused the Debian Bug report #542739,
regarding enable hardening options
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
542739: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=542739
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: sendmail
Version: 8.14.3-9
Severity: normal
Tags: patch
User: [email protected]
Usertags: origin-ubuntu karmic ubuntu-patch
Hello!
Since sendmail handles untrusted inputs and listens on a network port, I
think it might benefit from having hardening[1] enabled for its build.
The attached patch implements this.
Thanks!
-Kees
[1] http://wiki.debian.org/Hardening
--
Kees Cook @debian.org
diff -u sendmail-8.14.3/debian/control sendmail-8.14.3/debian/control
--- sendmail-8.14.3/debian/control
+++ sendmail-8.14.3/debian/control
@@ -4,7 +4,7 @@
Maintainer: Richard A Nelson (Rick) <[email protected]>
Standards-Version: 3.7.2
Build-Depends-Indep: groff, bsdmainutils
-Build-Depends: make (>> 3.79.1-14), m4, cdbs, quilt, patchutils, dh-buildinfo, debhelper (>= 5), linux-libc-dev (>= 2.6.21-3) [!kfreebsd-i386 !kfreebsd-amd64 !hurd-i386], groff, bsdmainutils , libdb4.7-dev, libldap2-dev, libwrap0-dev, liblockfile-dev, libsasl2-dev, libssl-dev
+Build-Depends: make (>> 3.79.1-14), m4, cdbs, quilt, patchutils, dh-buildinfo, debhelper (>= 5), linux-libc-dev (>= 2.6.21-3) [!kfreebsd-i386 !kfreebsd-amd64 !hurd-i386], groff, bsdmainutils , libdb4.7-dev, libldap2-dev, libwrap0-dev, liblockfile-dev, libsasl2-dev, libssl-dev, hardening-wrapper
Build-Conflicts: libbind-dev, bind-dev, fakeroot (<< 0.4.5)
Homepage: http://www.sendmail.org
diff -u sendmail-8.14.3/debian/rules sendmail-8.14.3/debian/rules
--- sendmail-8.14.3/debian/rules
+++ sendmail-8.14.3/debian/rules
@@ -4,6 +4,7 @@
#
# $Sendmail: rules,v 8.14.1 2007-05-27 18:30:00 cowboy Exp $
#------------------------------------------------------------------------------
+export DEB_BUILD_HARDENING=1
# CDBS crud
#include /usr/share/cdbs/1/class/makefile.mk
--- End Message ---
--- Begin Message ---
Source: sendmail
Source-Version: 8.14.4-1
We believe that the bug you reported is fixed in the latest version of
sendmail, which is due to be installed in the Debian FTP archive:
libmilter-dev_8.14.4-1_amd64.deb
to main/s/sendmail/libmilter-dev_8.14.4-1_amd64.deb
libmilter1.0.1-dbg_8.14.4-1_amd64.deb
to main/s/sendmail/libmilter1.0.1-dbg_8.14.4-1_amd64.deb
libmilter1.0.1_8.14.4-1_amd64.deb
to main/s/sendmail/libmilter1.0.1_8.14.4-1_amd64.deb
rmail_8.14.4-1_amd64.deb
to main/s/sendmail/rmail_8.14.4-1_amd64.deb
sendmail-base_8.14.4-1_all.deb
to main/s/sendmail/sendmail-base_8.14.4-1_all.deb
sendmail-bin_8.14.4-1_amd64.deb
to main/s/sendmail/sendmail-bin_8.14.4-1_amd64.deb
sendmail-cf_8.14.4-1_all.deb
to main/s/sendmail/sendmail-cf_8.14.4-1_all.deb
sendmail-doc_8.14.4-1_all.deb
to main/s/sendmail/sendmail-doc_8.14.4-1_all.deb
sendmail_8.14.4-1.diff.gz
to main/s/sendmail/sendmail_8.14.4-1.diff.gz
sendmail_8.14.4-1.dsc
to main/s/sendmail/sendmail_8.14.4-1.dsc
sendmail_8.14.4-1_all.deb
to main/s/sendmail/sendmail_8.14.4-1_all.deb
sendmail_8.14.4.orig.tar.gz
to main/s/sendmail/sendmail_8.14.4.orig.tar.gz
sensible-mda_8.14.4-1_amd64.deb
to main/s/sendmail/sensible-mda_8.14.4-1_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Richard A Nelson (Rick) <[email protected]> (supplier of updated sendmail
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Mon, 11 Sep 2010 17:53:00 -0000
Source: sendmail
Binary: sendmail-bin rmail sensible-mda libmilter1.0.1 libmilter1.0.1-dbg
libmilter-dev sendmail-doc sendmail sendmail-base sendmail-cf
Architecture: source all amd64
Version: 8.14.4-1
Distribution: unstable
Urgency: high
Maintainer: Richard A Nelson (Rick) <[email protected]>
Changed-By: Richard A Nelson (Rick) <[email protected]>
Description:
libmilter-dev - Sendmail Mail Filter API (Milter)
libmilter1.0.1 - Sendmail Mail Filter API (Milter)
libmilter1.0.1-dbg - Sendmail Mail Filter API (Milter)
rmail - MTA->UUCP remote mail handler
sendmail - powerful, efficient, and scalable Mail Transport Agent
sendmail-base - powerful, efficient, and scalable Mail Transport Agent
sendmail-bin - powerful, efficient, and scalable Mail Transport Agent
sendmail-cf - powerful, efficient, and scalable Mail Transport Agent
sendmail-doc - powerful, efficient, and scalable Mail Transport Agent
sensible-mda - Mail Delivery Agent wrapper
Closes: 510679 513298 527862 542739 553135 583108 589810 597779
Changes:
sendmail (8.14.4-1) unstable; urgency=high
.
* Long past due
.
* Re-enable libdb-dev, db4.8 working again
.
* New upstream
+ Null checking in certificate CN (CVE-2009-4565)
+ Queue identifier int overflow
+ Handle malformed DNS replies
+ milter segfault/Dos fixes
.
* Acknowledge NMUs - thanks !
+ rmail conflicts with masqmail
+ move dhcp hooks from /etc/dhcp3 to /etc/dhcp
+ CVE-2009-4565
.
* Correct issues with NMUs
+ Differing buildinfo.gz (all the same file) Closes: #597779
.
* Outstanding bugs:
+ Milter segfaults/Remote DoS? Closes: #527862
+ invoke.rc conditional Closes: #553135
+ We already harden Closes: #542739
+ Queue aging Closes: #583108
+ mail.local use of lockf Closes: #513298
+ init.d use of ps Closes: #510679
+ remove access on purge Closes: #589810
Checksums-Sha1:
72b66cfc7751c584fc25624a44ee56d16219ecf6 1483 sendmail_8.14.4-1.dsc
401096475f2e89f68ca5edc1456eb13269f950ad 2072180 sendmail_8.14.4.orig.tar.gz
162048537facebca6336e7f9bdba421aea35bd38 501535 sendmail_8.14.4-1.diff.gz
cd2b97f035aa6c9c22b7ed394259a1dde3ea993a 842142 sendmail-doc_8.14.4-1_all.deb
8e44ac0e0bb2504818660d7ece8b5fffe8912f74 211126 sendmail_8.14.4-1_all.deb
4236659f2f6775591a5a7da84e22b5940b164fdd 363566 sendmail-base_8.14.4-1_all.deb
d2a9b71b05fa0b195905307f05cec404b2e84b47 300032 sendmail-cf_8.14.4-1_all.deb
5e57bc4baaa535c712aad7c2c41eb9027d4caac6 982296 sendmail-bin_8.14.4-1_amd64.deb
57a0e16604409e1c84abfac255208025b1f1688c 248928 rmail_8.14.4-1_amd64.deb
77920182eccd4c73bb89d66f53ea237c1828aaf5 217100 sensible-mda_8.14.4-1_amd64.deb
41363948ff5acddbd1777cfec245b87974676aaf 240034
libmilter1.0.1_8.14.4-1_amd64.deb
be1d87f53bbde5f0d393cfd2e38949ea2f767e9a 256832
libmilter1.0.1-dbg_8.14.4-1_amd64.deb
8fff7077e31436c06f90a9509dbc8c87d2a986ee 332064
libmilter-dev_8.14.4-1_amd64.deb
Checksums-Sha256:
9bfe3990e1e732c0fac74027e144f30b3115581e8427d5e7de55e162f94105a8 1483
sendmail_8.14.4-1.dsc
40246cd35e99c40f22f4e88d328ff0084ef925257f2b0708a62ee6588725c7a3 2072180
sendmail_8.14.4.orig.tar.gz
9c287b1081dbc005f52c0bcd7738d912aa30457da6c5ffc89e9c34820527b141 501535
sendmail_8.14.4-1.diff.gz
c3c570f33872b39b3072125ace562865453a50924b56fae7419f839bcae0ed8b 842142
sendmail-doc_8.14.4-1_all.deb
4e9867250f37068e4e7c3f21b224cc687a1836d3acc764acca399d78ce8a5469 211126
sendmail_8.14.4-1_all.deb
0c13a31b094b608fc7301a3a2243127aac0881c1bc7f35c285d6b264518b469e 363566
sendmail-base_8.14.4-1_all.deb
d555a263b095ced7d463c5b3f94e8e639e42989500f7cf409d610f74db3cf968 300032
sendmail-cf_8.14.4-1_all.deb
b0faadccf20b4e26d9ed43be5f72dab660568e595025329d7678f157240f0a92 982296
sendmail-bin_8.14.4-1_amd64.deb
e54a1936ace1f970a863f057224add27d9cad416df03fc354ac80ec82fbbb69c 248928
rmail_8.14.4-1_amd64.deb
350afddfdaaa05f046ef3121ef366d0ee5ae877bc0a457a048645246dd403f94 217100
sensible-mda_8.14.4-1_amd64.deb
067d9d2f6858a952a97ead29e99da4c9faae501a3c02582baca694b9067df18a 240034
libmilter1.0.1_8.14.4-1_amd64.deb
977d0f2fd7d3fdaf947253ad907451bc17a94b9108cd339b08ce292c558db852 256832
libmilter1.0.1-dbg_8.14.4-1_amd64.deb
4c068e89c86f4affe6e83d693423731334152c829cd0f8952f14abaf4d049ea4 332064
libmilter-dev_8.14.4-1_amd64.deb
Files:
d142cc7777e52de06398530aaf2b36ea 1483 mail extra sendmail_8.14.4-1.dsc
55701f352bb8285e4de14ad6f3d48e35 2072180 mail extra sendmail_8.14.4.orig.tar.gz
a70712b3fac4deb231f31d0acf0c39b3 501535 mail extra sendmail_8.14.4-1.diff.gz
3dbf311dcbba36e687e565cd1233521d 842142 doc extra sendmail-doc_8.14.4-1_all.deb
a24ad0987d36425e5a0f165588b99cc1 211126 mail extra sendmail_8.14.4-1_all.deb
d296c83855ca90dce3ea2d1240dc267e 363566 mail extra
sendmail-base_8.14.4-1_all.deb
83f671b260408a795a2efc3343012f82 300032 mail extra sendmail-cf_8.14.4-1_all.deb
7a12d34c9ab61bf90cf767323e3d476b 982296 mail extra
sendmail-bin_8.14.4-1_amd64.deb
19795ca980591df412bef501d753718e 248928 mail extra rmail_8.14.4-1_amd64.deb
f7c52f39046ad023240cdc5556df65eb 217100 mail extra
sensible-mda_8.14.4-1_amd64.deb
6b9c5eb34f38a1c2c9a27d29d7ec2ec1 240034 libs extra
libmilter1.0.1_8.14.4-1_amd64.deb
84d5940660fb2b92579cae9e3ce04057 256832 libs extra
libmilter1.0.1-dbg_8.14.4-1_amd64.deb
5e66b7bd084f1f962864bd99642c722a 332064 libdevel extra
libmilter-dev_8.14.4-1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAky6ATMACgkQAVQn46S0dnbT5wCcCdxtFPW7x/4xG1UQlVJXsS++
Gb4Anjdmtd9pByLwF4iisillWq+cmQ2O
=z8gV
-----END PGP SIGNATURE-----
--- End Message ---
