GENTOO LINUX SECURITY ANNOUNCEMENT 200309-13
| PACKAGE | : | sendmail |
| SUMMARY | : | buffer overflows |
| DATE | : | 2003-09-17 20:52 UTC |
| EXPLOIT | : | remote |
| VERSIONS AFFECTED | : | |
| FIXED VERSION | : | >=sendmail-8.2.10 |
| CVE | : |
quote from release notes:
“Fix a buffer overflow in address parsing. Problem detected by
Michal Zalewski, patch from Todd C. Miller of Courtesan
Consulting.
Fix a potential buffer overflow in ruleset parsing. This problem
is not exploitable in the default sendmail configuration; only if
non-standard rulesets recipient (2), final (4), or mailer-specific
envelope recipients rulesets are used then a problem may occur.
Problem noted by Timo Sirainen.”
SOLUTION
It is recommended that all Gentoo Linux users who are running
net-mail/sendmail upgrade to sendmail-8.2.10 as follows:
emerge sync
emerge sendmail
emerge clean
[email protected] – GnuPG key is
available at http://dev.gentoo.org/~aliz