Re: Patch for asynch sendmail vulnerability on OPENBSD_3_6 stable

[O b s d]

I run 3.5.  Sendmail in 3.7 sources compiled and installed cleanly.





From: Michael Flanagan [EMAIL PROTECTED]
To: misc@openbsd.org
Subject: Patch for asynch sendmail vulnerability on OPENBSD_3_6 stable
Date: Fri, 14 Apr 2006 05:03:29 -0700

I found myself needing up apply the recent patch for sendmail against  an 
aging 3.6 stable box.


I took the sendmail patch for the 3.7 stable branch and applied it  against 
3.6 stable. It applied cleanly with the exception of a half  dozen hunks in 
a couple of files. I merged those by hand and am up  and running with a 
rebuilt sendmail.


In case this saves anyone a little time, I've created a diff of what  I'm 
running against 3.6 stable. It applies cleanly. You can find it  here:


http://pokernut.net/wp-content/OPENBSD36_sendmail.patch

Michael

http://ninemsn.com.au/share/redir/adTrack.asp?mode=clickclientID=689referral=hotmailtaglineURL=http://partyfever.ninemsn.com.au/compintro.aspx?compid=209

Patch for asynch sendmail vulnerability on OPENBSD_3_6 stable

[Michael Flanagan]

I found myself needing up apply the recent patch for sendmail against  
an aging 3.6 stable box.


I took the sendmail patch for the 3.7 stable branch and applied it  
against 3.6 stable. It applied cleanly with the exception of a half  
dozen hunks in a couple of files. I merged those by hand and am up  
and running with a rebuilt sendmail.


In case this saves anyone a little time, I've created a diff of what  
I'm running against 3.6 stable. It applies cleanly. You can find it  
here:


http://pokernut.net/wp-content/OPENBSD36_sendmail.patch

Michael

Re: Patch for asynch sendmail vulnerability on OPENBSD_3_6 stable

[Will H. Backman]

Michael Flanagan wrote:
I found myself needing up apply the recent patch for sendmail against 
an aging 3.6 stable box.


I took the sendmail patch for the 3.7 stable branch and applied it 
against 3.6 stable. It applied cleanly with the exception of a half 
dozen hunks in a couple of files. I merged those by hand and am up and 
running with a rebuilt sendmail.


In case this saves anyone a little time, I've created a diff of what 
I'm running against 3.6 stable. It applies cleanly. You can find it here:


http://pokernut.net/wp-content/OPENBSD36_sendmail.patch

Michael

Does anyone know of any tests for the problem?  How would I test such an 
unofficial patch?  I never did see anything that said OpenBSD was 
affected by the problem, and I'm always hoping that some of the OS level 
protections might help in situations like this.

Re: Patch for asynch sendmail vulnerability on OPENBSD_3_6 stable

[Ted Unangst]

On 4/14/06, Will H. Backman [EMAIL PROTECTED] wrote:
 unofficial patch?  I never did see anything that said OpenBSD was
 affected by the problem, and I'm always hoping that some of the OS level
 protections might help in situations like this.

not likely.