SOT Linux Security Advisory
| Subject: | Updated sendmail package for SOT Linux 2003 |
| Advisory ID: | SLSA-2003:43 |
| Date: | Thursday, September 18, 2003 |
| Product: | SOT Linux 2003 |
1. Problem description
Sendmail is a widely used Mail Transport Agent (MTA).
There is a vulnerability in Sendmail versions prior to and
including 8.12.9. Michal Zalewski discovered a buffer overflow in
address parsing, patch from Todd C. Miller of Courtesan
Consulting.
All users are advised to update to these erratum packages
containing a backported patch which corrects these
vulnerabilities.
2. Updated packages
SOT Linux 2003 Desktop:
i386:
ftp://ftp.sot.com/updates/2003/Desktop/i386/sendmail-8.12.9-4.i386.rpm
SRPMS:
ftp://ftp.sot.com/updates/2003/Desktop/SRPMS/sendmail-8.12.9-4.src.rpm
SOT Linux 2003 Server:
i386:
ftp://ftp.sot.com/updates/2003/Server/i386/sendmail-8.12.9-4.i386.rpm
SRPMS:
ftp://ftp.sot.com/updates/2003/Server/SRPMS/sendmail-8.12.9-4.src.rpm
3. Upgrading package
Before applying this update, make sure all previously released
errata relevant to your system have been applied.
Use up2date to automatically upgrade the fixed packages.
If you want to upgrade manually, download the updated package
from the SOT Linux FTP site (use the links above) or from one of
our mirrors. The list of mirrors can be obtained at www.sot.com/en/linux
Update the package with the following command: rpm -Uvh
<filename>
4. Verification
All packages are PGP signed by SOT for security.
You can verify each package with the following command: rpm
–checksig <filename>
If you wish to verify the integrity of the downloaded package,
run “md5sum <filename>” and compare the output with data
given below.
Package Name MD5 sum
/Desktop/i386/sendmail-8.12.9-4.i386.rpm
ef0ee5b616b5e1508959af31a1c61f62
/Desktop/SRPMS/sendmail-8.12.9-4.src.rpm
1e867a0d9b84f8808297defd0ac8aa8d
/Server/i386/sendmail-8.12.9-4.i386.rpm
ef0ee5b616b5e1508959af31a1c61f62
/Server/SRPMS/sendmail-8.12.9-4.src.rpm
1e867a0d9b84f8808297defd0ac8aa8d
Copyright(c) 2001-2003 SOT