OpenPKG CVS Repository
http://cvs.openpkg.org/
____________________________________________________________________________
Server: cvs.openpkg.org Name: Michael van Elst
Root: /e/openpkg/cvs Email: [EMAIL PROTECTED]
Module: openpkg-web Date: 26-Aug-2003 12:24:18
Branch: HEAD Handle: 2003082611241800
Added files:
openpkg-web/security OpenPKG-SA-2003.037-sendmail.txt
Log:
SA-2003.037; dnsmap free on uninitialized data
Summary:
Revision Changes Path
1.1 +81 -0 openpkg-web/security/OpenPKG-SA-2003.037-sendmail.txt
____________________________________________________________________________
patch -p0 <<'@@ .'
Index: openpkg-web/security/OpenPKG-SA-2003.037-sendmail.txt
============================================================================
$ cvs diff -u -r0 -r1.1 OpenPKG-SA-2003.037-sendmail.txt
--- /dev/null 2003-08-26 12:24:18.000000000 +0200
+++ OpenPKG-SA-2003.037-sendmail.txt 2003-08-26 12:24:18.000000000 +0200
@@ -0,0 +1,81 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
+________________________________________________________________________
+
+OpenPKG Security Advisory The OpenPKG Project
+http://www.openpkg.org/security.html http://www.openpkg.org
[EMAIL PROTECTED] [EMAIL PROTECTED]
+OpenPKG-SA-SA-2003.037 26-Aug-2003
+________________________________________________________________________
+
+Package: sendmail
+Vulnerability: denial of service
+OpenPKG Specific: no
+
+Affected Releases: Affected Packages: Corrected Packages:
+OpenPKG CURRENT none N.A.
+OpenPKG 1.3 none N.A.
+OpenPKG 1.2 <= sendmail-8.12.7-1.2.2 >= sendmail-8.12.7-1.2.3
+
+Dependent Packages: none
+
+Description:
+ Oleg Bulyzhin discovered [1] a confirmed [2] denial of service
+ vulnerability in all version of the Sendmail [0] MTA earlier than
+ 8.12.9. In dns_free_data() sendmail tries to free an allocated chain
+ of structures: it's going through chain using rr_next pointer and
+ stops when rr_next == NULL. Garbage in the rr_next field then causes
+ sendmail to call free() on random addresses. This usually causes
+ sendmail to crash.
+
+ Please check whether you are affected by running "<prefix>/bin/rpm
+ -q sendmail". If you have the "sendmail" package installed and its
+ version is affected (see above), we recommend that you immediately
+ upgrade it (see Solution). [3][4]
+
+Solution:
+ Select the updated source RPM appropriate for your OpenPKG release
+ [5], fetch it from the OpenPKG FTP service [6] or a mirror location,
+ verify its integrity [7], build a corresponding binary RPM from it [3]
+ and update your OpenPKG installation by applying the binary RPM [4].
+ For the current release OpenPKG 1.3, perform the following operations
+ to permanently fix the security problem (for other releases adjust
+ accordingly).
+
+ $ ftp ftp.openpkg.org
+ ftp> bin
+ ftp> cd release/1.3/UPD
+ ftp> get sendmail-8.12.7-1.2.3.src.rpm
+ ftp> bye
+ $ <prefix>/bin/rpm -v --checksig sendmail-8.12.7-1.2.3.src.rpm
+ $ <prefix>/bin/rpm --rebuild sendmail-8.12.7-1.2.3.src.rpm
+ $ su -
+ # <prefix>/bin/rpm -Fvh <prefix>/RPM/PKG/sendmail-8.12.7-1.2.3.*.rpm
+________________________________________________________________________
+
+References:
+ [0] http://www.sendmail.org/
+ [1] http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/54367
+ [2] http://www.sendmail.org/dnsmap1.html
+ [3] http://www.openpkg.org/tutorial.html#regular-source
+ [4] http://www.openpkg.org/tutorial.html#regular-binary
+ [5] ftp://ftp.openpkg.org/release/1.3/UPD/sendmail-8.12.7-1.2.3.src.rpm
+ [6] ftp://ftp.openpkg.org/release/1.3/UPD/
+ [7] http://www.openpkg.org/security.html#signature
+________________________________________________________________________
+
+For security reasons, this advisory was digitally signed with the
+OpenPGP public key "OpenPKG <[EMAIL PROTECTED]>" (ID 63C4CB9F) of the
+OpenPKG project which you can retrieve from http://pgp.openpkg.org and
+hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org/
+for details on how to verify the integrity of this advisory.
+________________________________________________________________________
+
+-----BEGIN PGP SIGNATURE-----
+Comment: OpenPKG <[EMAIL PROTECTED]>
+
+iD8DBQE+huYSgHWT4GPEy58RAhdpAKDGqKOKSGwfuxVT5imK+1H0LBDcPACgu1nq
+cia1t2PI8lNReMIeza3KLKI=
+=38Sm
+-----END PGP SIGNATURE-----
@@ .
______________________________________________________________________
The OpenPKG Project www.openpkg.org
CVS Repository Commit List [EMAIL PROTECTED]
