SHARE
Facebook X Pinterest WhatsApp

Debian GNU/Linux Asvisories: openssl, rinetd, sendmail-wide

Written By
Web Webster
Web Webster
Apr 17, 2003 
- --------------------------------------------------------------------------
Debian Security Advisory DSA 288-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
April 17th, 2003                        http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : openssl
Vulnerability  : several vulnerabilities
Problem-Type   : remote
Debian-specific: no
CVE Id         : CAN-2003-0147 CAN-2003-0131

Researchers discovered two flaws in OpenSSL, a Secure Socket Layer
(SSL) library and related cryptographic tools.  Applications that are
linked against this library are generally vulnerable to attacks that
could leak the server's private key or make the encrypted session
decryptable otherwise.  The Common Vulnerabilities and Exposures (CVE)
project identified the following vulnerabilities:

CAN-2003-0147

   OpenSSL does not use RSA blinding by default, which allows local and
   remote attackers to obtain the server's private key.

CAN-2003-0131

   The SSL and allow remote attackers to perform an unauthorized RSA
   private key operation that cause OpenSSL to leak information
   regarding the relationship between ciphertext and the associated
   plaintext.

For the stable distribution (woody) these problems have been fixed in
version 0.9.6c-2.woody.3.

For the old stable distribution (potato) these problems have been
fixed in version 0.9.6c-0.potato.6.

For the unstable distribution (sid) these problems have been fixed in
version 0.9.7b-1 of openssl and version 0.9.6j-1 of openssl096.

We recommend that you upgrade your openssl packages immediately and
restart the applications that use OpenSSL.

Unfortunately, RSA blinding is not thread-safe and will cause failures
for programs that use threads and OpenSSL such as stunnel.  However,
since the proposed fix would change the binary interface (ABI),
programs that are dynamically linked against OpenSSL won't run
anymore.  This is a dilemma we can't solve.

You will have to decide whether you want the security update which is
not thread-safe and recompile all applications that apparently fail
after the upgrade, or fetch the additional source packages at the end
of this advisory, recompile it and use a thread-safe OpenSSL library
again, but also recompile all applications that make use of it (such
as apache-ssl, mod_ssl, ssh etc.).

However, since only very few packages use threads and link against the
OpenSSL library most users will be able to use packages from this
update without any problems.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 2.2 alias potato
- ---------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-0.potato.6.dsc
      Size/MD5 checksum:      634 10591fc4770bca4a1f9ea379776d6984
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-0.potato.6.diff.gz
      Size/MD5 checksum:    43587 0fe901b034e33fa6438f2eaa8ff944e8
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c.orig.tar.gz
      Size/MD5 checksum:  2153980 c8261d93317635d56df55650c6aeb3dc

  Architecture independent components:

    http://security.debian.org/pool/updates/main/o/openssl/ssleay_0.9.6c-0.potato.6_all.deb
      Size/MD5 checksum:      974 bec952e2a37b656b0a119d34b49e5b76

  Alpha architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-0.potato.6_alpha.deb
      Size/MD5 checksum:  1550896 18a0220e4fe8a40d284949fb152793d2
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-0.potato.6_alpha.deb
      Size/MD5 checksum:   591474 c7372983cf09686d71419432f441d975
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-0.potato.6_alpha.deb
      Size/MD5 checksum:   746872 dd4f597dd5bbd758cb1ba62d7dc9f859

  ARM architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-0.potato.6_arm.deb
      Size/MD5 checksum:  1349872 91e13598de08a3644db2922a30a679ac
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-0.potato.6_arm.deb
      Size/MD5 checksum:   470164 6fa5ef903dd2a8a0b29cd71f406fdc6f
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-0.potato.6_arm.deb
      Size/MD5 checksum:   730160 1b35d2d5bbb68459fa63c5a7f2d6c10d

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-0.potato.6_i386.deb
      Size/MD5 checksum:  1288032 3850ab8283aca40c94ca9a00647d6310
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-0.potato.6_i386.deb
      Size/MD5 checksum:   464042 3a55b08aa1d4cf668ccb1293db131cb4
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-0.potato.6_i386.deb
      Size/MD5 checksum:   724766 1d1a726fce6def52ceed5481dfbcfd16

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-0.potato.6_m68k.deb
      Size/MD5 checksum:  1263766 978b891779cee8ec309333256f7c9359
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-0.potato.6_m68k.deb
      Size/MD5 checksum:   452710 7ad96d59e082d4eaa7d2f80c65a26eb0
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-0.potato.6_m68k.deb
      Size/MD5 checksum:   721640 f05db1fde1a6487f192c79e695afc498

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-0.potato.6_powerpc.deb
      Size/MD5 checksum:  1385386 c6b4d0b82af7e7da562e89836add31cd
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-0.potato.6_powerpc.deb
      Size/MD5 checksum:   504304 f3f74025eb51a78191717d00ca2ed9bc
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-0.potato.6_powerpc.deb
      Size/MD5 checksum:   727426 a166aa6d87cde7df75c62d92eb185b74

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-0.potato.6_sparc.deb
      Size/MD5 checksum:  1343526 4918ae13675c2ac1f33324fa499e545b
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-0.potato.6_sparc.deb
      Size/MD5 checksum:   484244 923e7e5aa94449f5a659b43bc1332b36
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-0.potato.6_sparc.deb
      Size/MD5 checksum:   738452 4b94d3325744a8275922af9ff0c9977c


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.3.dsc
      Size/MD5 checksum:      632 c319c5b91489189a4cd08e2d5ad9db24
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.3.diff.gz
      Size/MD5 checksum:    44230 523138ce8166309cff8708422c45f25d
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c.orig.tar.gz
      Size/MD5 checksum:  2153980 c8261d93317635d56df55650c6aeb3dc

  Architecture independent components:

    http://security.debian.org/pool/updates/main/o/openssl/ssleay_0.9.6c-2.woody.3_all.deb
      Size/MD5 checksum:      974 7dec86ca4a69dc9f31b301e73b7caaf8

  Alpha architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.3_alpha.deb
      Size/MD5 checksum:  1551332 9f26f7d9e8de5d10970d71380a1c4ac3
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.3_alpha.deb
      Size/MD5 checksum:   571108 8f0ce22ecbe4258afe9da1854913236a
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.3_alpha.deb
      Size/MD5 checksum:   736170 5f480e031750c0d342bfe39f85f5aca7

  ARM architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.3_arm.deb
      Size/MD5 checksum:  1357932 7d54731ce61c36fea971ac7b470f455e
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.3_arm.deb
      Size/MD5 checksum:   473936 84b8cf64bb93d762c46301a9ebb5bda1
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.3_arm.deb
      Size/MD5 checksum:   729648 14eb0ca3b7b1ed398429cb32973fa5d3

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.3_i386.deb
      Size/MD5 checksum:  1290214 0e2f917c1e6a5ddb0ce86ba5ab7db78d
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.3_i386.deb
      Size/MD5 checksum:   461564 48537d32b42d35ef1d716a10be1ae3b4
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.3_i386.deb
      Size/MD5 checksum:   722960 89f47586c8c141050bae0a53dfb5fc6d

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.3_ia64.deb
      Size/MD5 checksum:  1615338 70bf2b0a8e890ae272266a5009d9e348
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.3_ia64.deb
      Size/MD5 checksum:   710900 9d150d59bff981cdb3243c4f5351714d
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.3_ia64.deb
      Size/MD5 checksum:   763438 b7029961edc6506e3721e5963a1a4e00

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.3_hppa.deb
      Size/MD5 checksum:  1434914 f8986d3f878776b79f2bbe0b03267bc2
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.3_hppa.deb
      Size/MD5 checksum:   564778 fae0d532efb2e022bfe56a4823b98b0c
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.3_hppa.deb
      Size/MD5 checksum:   741772 b3a93bc9f7003e1d691904f7ee795183

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.3_m68k.deb
      Size/MD5 checksum:  1266522 0a456cebb2b98edb7f83258a7dda52a3
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.3_m68k.deb
      Size/MD5 checksum:   450532 7331cb9cfff14f8c676d566a2ea99da1
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.3_m68k.deb
      Size/MD5 checksum:   720300 12f5e2cd2e9bc7e6754e8c5b2bb9a98a

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.3_mips.deb
      Size/MD5 checksum:  1416102 9e76c0e93e6a56aee5eb7c236cc2800c
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.3_mips.deb
      Size/MD5 checksum:   483556 39302c76273cd278f5ff3bddd79ac002
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.3_mips.deb
      Size/MD5 checksum:   717674 c0102138e017690bd2e2bacbbb7923e1

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.3_mipsel.deb
      Size/MD5 checksum:  1410154 2d8f191b102de75965d8027f9b9e59c3
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.3_mipsel.deb
      Size/MD5 checksum:   476594 e57c083d10e9480f4918b926c045277f
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.3_mipsel.deb
      Size/MD5 checksum:   716996 73e406755be34bcd4ab4375e32fe31b0

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.3_powerpc.deb
      Size/MD5 checksum:  1386698 8b296b0c0c73592d9bc712cbc1623371
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.3_powerpc.deb
      Size/MD5 checksum:   502292 d2b5ab4e74589b60b3431ccf9878698c
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.3_powerpc.deb
      Size/MD5 checksum:   726550 894d497326cff93c1ea2598874dd3cf6

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.3_s390.deb
      Size/MD5 checksum:  1326332 e2bd80e76e1143879ea3108bcbfd8dbf
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.3_s390.deb
      Size/MD5 checksum:   510344 3995f9758870aef5910e2a6c2f9131f7
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.3_s390.deb
      Size/MD5 checksum:   731512 f3f492d0fba0f3705b25bd338898194b

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.6c-2.woody.3_sparc.deb
      Size/MD5 checksum:  1344130 f4170862c53fa45168eeb37472b8f156
    http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.6_0.9.6c-2.woody.3_sparc.deb
      Size/MD5 checksum:   484622 6e7c3a1af508ac8108bbc000aab920aa
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.3_sparc.deb
      Size/MD5 checksum:   737048 92a5777b5fc869bc6af8632b3e0f6b82


  These files will probably be moved into the stable distribution on
  its next revision.


Debian GNU/Linux 2.2 alias potato
- ---------------------------------

    http://master.debian.org/~joey/NMU/openssl_0.9.6c-0.potato.7.dsc
      Size/MD5 checksum:      634 625fa03d0b4f5a78f6ef87785882a586
    http://master.debian.org/~joey/NMU/openssl_0.9.6c-0.potato.7.diff.gz
      Size/MD5 checksum:    45821 7eacbcb7c936d6c710e8b1344698f5aa
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c.orig.tar.gz
      Size/MD5 checksum:  2153980 c8261d93317635d56df55650c6aeb3dc
    http://master.debian.org/~joey/NMU/openssl_0.9.6c-0.potato.7.patch
      Size/MD5 checksum:     8350 e82621f5cad4cfa4dbff4d39556f85f3

Debian GNU/Linux 3.0 alias woody
- --------------------------------

    http://master.debian.org/~joey/NMU/openssl_0.9.6c-2.woody.4.dsc
      Size/MD5 checksum:      632 9fbbff3117baf67823df792ba68875fb
    http://master.debian.org/~joey/NMU/openssl_0.9.6c-2.woody.4.diff.gz
      Size/MD5 checksum:    46397 4dcd653f6295191c25c71f30b0150109
    http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c.orig.tar.gz
      Size/MD5 checksum:  2153980 c8261d93317635d56df55650c6aeb3dc
    http://master.debian.org/~joey/NMU/openssl_0.9.6c-2.woody.4.patch
      Size/MD5 checksum:     8327 a6d1d8bbe917661d426f0669fbf0c78c


- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and http://packages.debian.org/;

- --------------------------------------------------------------------------
Debian Security Advisory DSA 289-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
April 17th, 2003                        http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : rinetd
Vulnerability  : incorrect memory resizing
Problem-Type   : remote
Debian-specific: no
CVE Id         : CAN-2003-0212

Sam Hocevar discovered a security problem in rinetd, an IP connection
redirection server.  When the connection list is full, rinetd resizes
the list in order to store the new incoming connection.  However, this
is done improperly, resulting in a denial of service and potentially
execution of arbitrary code.

For the stable distribution (woody) this problem has been fixed in
version 0.61-1.1.

For the old stable distribution (potato) this problem has been
fixed in version 0.52-2.1.

For the unstable distribution (sid) this problem has been fixed in
version 0.61-2

We recommend that you upgrade your rinetd package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 2.2 alias potato
- ---------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.52-2.1.dsc
      Size/MD5 checksum:      529 d2e500fcd901d2d95c5f6b6425a52c08
    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.52-2.1.diff.gz
      Size/MD5 checksum:     2709 7d0d2f5973b1f846bf3510056bc04ba1
    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.52.orig.tar.gz
      Size/MD5 checksum:    37061 27ea6c84c2a23712c82f6661db50db84

  Alpha architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.52-2.1_alpha.deb
      Size/MD5 checksum:    22218 e8614a8e5ee5d995095a512a0a39d953

  ARM architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.52-2.1_arm.deb
      Size/MD5 checksum:    21340 e4245bc0bc5d1e8db5b1748d5f6b0c65

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.52-2.1_i386.deb
      Size/MD5 checksum:    19668 826434042bdefafb5061686ffbf84d58

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.52-2.1_m68k.deb
      Size/MD5 checksum:    19134 40e563e72eb4d5021809f8c529a7b278

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.52-2.1_powerpc.deb
      Size/MD5 checksum:    19436 4e7c1b0e2f14c9fd5079587a8c1f17f4

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.52-2.1_sparc.deb
      Size/MD5 checksum:    22488 b1b427b1756ca6514701bc03593ff758


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61-1.1.dsc
      Size/MD5 checksum:      552 ebb1a8e214c048294d0e8eedb9ed0436
    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61-1.1.diff.gz
      Size/MD5 checksum:     2947 655c6a2d5d97c9f0c3d0361e414829d4
    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61.orig.tar.gz
      Size/MD5 checksum:    35718 850d5b32cd53339e200e978b5cd06c7d

  Alpha architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61-1.1_alpha.deb
      Size/MD5 checksum:    22980 0b44b269d5e377b534c602b3680a495e

  ARM architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61-1.1_arm.deb
      Size/MD5 checksum:    22940 0e1503b368786bbc62d9e5f4e69daf5f

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61-1.1_i386.deb
      Size/MD5 checksum:    20846 47b483fd4e519748fde85679f127d8f4

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61-1.1_ia64.deb
      Size/MD5 checksum:    27694 7e0759e67d0e4c500c1169d12e3bd09c

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61-1.1_hppa.deb
      Size/MD5 checksum:    21326 e79312cfc10d341de6696046b34fb2b2

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61-1.1_m68k.deb
      Size/MD5 checksum:    20362 c4977c42e178aca4f7557d7b518bbc4d

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61-1.1_mips.deb
      Size/MD5 checksum:    22166 3408a418f53baf79476954a1d92db64d

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61-1.1_mipsel.deb
      Size/MD5 checksum:    22126 e40de2ae705f61a24c229e835f7008b8

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61-1.1_powerpc.deb
      Size/MD5 checksum:    20592 adb2fb03b7a699fb2d27d2513e5e3a84

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61-1.1_s390.deb
      Size/MD5 checksum:    21442 330a6cb0f51afeb3b0aa2a6f9fb1f488

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/r/rinetd/rinetd_0.61-1.1_sparc.deb
      Size/MD5 checksum:    23648 3783d35a77ac4547fb011c8991c21439


  These files will probably be moved into the stable distribution on
  its next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and http://packages.debian.org/;


- --------------------------------------------------------------------------
Debian Security Advisory DSA 290-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
April 17th, 2003                        http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : sendmail-wide
Vulnerability  : char-to-int conversion
Problem-Type   : local, maybe remote
Debian-specific: no
CVE Id         : CAN-2003-0161
CERT advisories: VU#897604 CA-2003-12

Michal Zalewski discovered a buffer overflow, triggered by a char to
int conversion, in the address parsing code in sendmail, a widely used
powerful, efficient, and scalable mail transport agent.  This problem
is potentially remotely exploitable.

For the stable distribution (woody) this problem has been fixed in
version 8.12.3+3.5Wbeta-5.4

For the old stable distribution (potato) this problem has been
fixed in version 8.9.3+3.2W-25

For the unstable distribution (sid) this problem has been
fixed in version 8.12.9+3.5Wbeta-1

We recommend that you upgrade your sendmail-wide packages.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 2.2 alias potato
- ---------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-25.dsc
      Size/MD5 checksum:      541 17dd53835e894bc4213d2555384aff75
    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-25.tar.gz
      Size/MD5 checksum:  1273704 63cd21c58e45810b21601025c164a85e

  Alpha architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-25_alpha.deb
      Size/MD5 checksum:   302722 8b36867359dd0267d8664b290899ec6b

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-25_i386.deb
      Size/MD5 checksum:   217690 f98998b9467ce368b11a862dbe5d4e82

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-25_m68k.deb
      Size/MD5 checksum:   202538 e56cc6579ae7da5693047a7e9ceec33e

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-25_powerpc.deb
      Size/MD5 checksum:   242694 33217654adca1e26bf9e27b4fb96050e

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-25_sparc.deb
      Size/MD5 checksum:   236530 32fabe460c63c6fd343d4741104a73f3


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.4.dsc
      Size/MD5 checksum:      738 26af096d7a10d63aec72a0b38982973d
    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.4.diff.gz
      Size/MD5 checksum:   326292 b98e1e9bb74233e1842a0562912b748d
    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta.orig.tar.gz
      Size/MD5 checksum:  1870451 4c7036e8042bae10a90da4a84a717963

  Alpha architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.4_alpha.deb
      Size/MD5 checksum:   440622 d2800104eff39be1a94b94d049e77fc1

  ARM architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.4_arm.deb
      Size/MD5 checksum:   369412 d63f3107518282fc892835c5251afdcd

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.4_i386.deb
      Size/MD5 checksum:   328794 139dcce3e908b45be6ecd74531279184

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.4_ia64.deb
      Size/MD5 checksum:   574908 7ebf517265802b0abaf41d3eeca27b6d

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.4_hppa.deb
      Size/MD5 checksum:   413604 9f353dbc5f1c3eca9e34da0e34f227c5

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.4_m68k.deb
      Size/MD5 checksum:   300726 6b9f6f9c143f2ae0d5e3b95c9e74d90e

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.4_mips.deb
      Size/MD5 checksum:   378324 22c8467712e9da461043110a86c23dcc

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.4_mipsel.deb
      Size/MD5 checksum:   380264 ae297336eb7a608f4cdacb3b5cdbf4aa

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.4_powerpc.deb
      Size/MD5 checksum:   362854 522d8c46a0e8e6b6c143e6e7eac502e6

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.4_s390.deb
      Size/MD5 checksum:   354776 62f538f78d8d17519c74064473cad1c2

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.4_sparc.deb
      Size/MD5 checksum:   355964 01de0e06a7bc0fde26b08b7d84e53246


  These files will probably be moved into the stable distribution on
  its next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>;
Web Webster

Web Webster

Web Webster has more than 20 years of writing and editorial experience in the tech sector. He’s written and edited news, demand generation, user-focused, and thought leadership content for business software solutions, consumer tech, and Linux Today, he edits and writes for a portfolio of tech industry news and analysis websites including webopedia.com, and DatabaseJournal.com.

Linux Today Logo

LinuxToday is a trusted, contributor-driven news resource supporting all types of Linux users. Our thriving international community engages with us through social media and frequent content contributions aimed at solving problems ranging from personal computing to enterprise-level IT operations. LinuxToday serves as a home for a community that struggles to find comparable information elsewhere on the web.

facebook
linkedin
x

Company

Contact us

Categories

News IT Management Infrastructure Developer Security High Performance Storage Blog

Property of TechnologyAdvice. © 2026 TechnologyAdvice. All Rights Reserved

Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

Terms of Service Privacy Policy California - Do Not Sell My Information