-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200309-13 - - - ---------------------------------------------------------------------
� � � � � PACKAGE : sendmail � � � � � SUMMARY : buffer overflows � � � � � � �DATE : 2003-09-17 20:52 UTC � � � � � EXPLOIT : remote VERSIONS AFFECTED : <sendmail-8.2.10 � � FIXED VERSION : >=sendmail-8.2.10 � � � � � � � CVE : - - - --------------------------------------------------------------------- quote from release notes: "Fix a buffer overflow in address parsing. Problem detected by Michal Zalewski, patch from Todd C. Miller of Courtesan Consulting. Fix a potential buffer overflow in ruleset parsing. This problem is not exploitable in the default sendmail configuration; only if non-standard rulesets recipient (2), final (4), or mailer-specific envelope recipients rulesets are used then a problem may occur. Problem noted by Timo Sirainen." SOLUTION It is recommended that all Gentoo Linux users who are running net-mail/sendmail upgrade to sendmail-8.2.10 as follows: emerge sync emerge sendmail emerge clean - - - --------------------------------------------------------------------- [EMAIL PROTECTED] - GnuPG key is available at http://dev.gentoo.org/~aliz - - - --------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQE/aMmXfT7nyhUpoZMRAoyYAJwOr62OQN3G+SXYMC5QXPuU2EjYbACcCfVL rSrMrf+lRPq9Nqh+pa18i8A= =c+4s -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
