| WIKI | FAQ | Tech FAQ | |
 http://csua.com/feed/ | |
| ||||||
| 4/7 |
| 2003/9/17-20 [Computer/SW/Mail] UID:10232 Activity:nil |
9/16 For those of your who are running sendmail 8.12.9 there is
a new exploit:
http://www.securityfocus.com/archive/1/337839/2003-09-14/2003-09-20/0
Patch for 8.12.9: http://www.sendmail.org/parse8.359.2.8.html
Version 8.12.10: http://www.sendmail.org/8.12.10.html
\_ I'm going to just stop using email, stop logging in, stop using a
browser, and go back to ftp, gopher, and telnet when it was safe
to be on the net. What's the last gopher or telnet exploit you've
heard of?
\_ tcpdump
\_ I'm not on your network. I'm switching to telnet for
everything. Anyway, no one is going to be looking for the
clear text wheat among the crypto chaff so I'm safe.
\_ tcpdump tcp port telnet
If all of your systems are on the same switch and
vlan you are probably okay, otherwise I'd be careful.
BTW, its not like telnetd and inetd (or xinetd) are
exploit free.
\_ Arrr!
\_ Avast! |
| 4/7 |
|
| www.securityfocus.com/archive/1/337839/2003-09-14/2003-09-20/0 Hello lists, - Overview - There seems to be a remotely exploitable vulnerability in Sendmail up to and including the latest version, 8129 The problem lies in prescan function, but is not related to previous issues with this code. The primary attack vector is an indirect invocation via parseaddr, although other routes are possible. Heap or stack structures, depending on the calling location, can be overwritten due to the ability to go past end of the input buffer in strtok-alike routines. |
| www.sendmail.org/parse8.359.2.8.html Notice: after you applied the appropriate patch as explained below, you must recompile sendmail and install the new binary. See the instructions for your sendmail versions how to do that. PGP signature or at least the MD5 checksum: 7a8a550f2b82ee9ef78dadc99177d84c , and apply the following command in the sendmail-VERSION/sendmail/ directory. You should also edit the file It might also be useful to edit the file sendmail/versionc and change the version number to indicate that you changed sendmail. Then recompile sendmail, install the new binary, and restart the daemon. Note: make sure your patch program understands these diffs. Some versions can not deal with them. In that case install GNU patch on Solaris: try gpatch. |
| www.sendmail.org/8.12.10.html Remember to check the PGP signatures of patches or releases obtained via FTP or HTTP to check the correctness of the patch in this announcement please verify the PGP signature of it. For those not running the open source version, check with your vendor for a patch. Note: we are aware of the fact that the release notes state 2003/09/24 as release date but that the actual release occurred on 2003/09/17. The former was the scheduled release date, the latter was required by early public disclosure. The PGP signature was created using the Sendmail Signing Key/2003, available on the web site or on the public key servers. Since sendmail 811 and later includes hooks to cryptography, the following information from OpenSSL applies to sendmail as well. PLEASE REMEMBER THAT EXPORT/IMPORT AND/OR USE OF STRONG CRYPTOGRAPHY SOFTWARE, PROVIDING CRYPTOGRAPHY HOOKS OR EVEN JUST COMMUNICATING TECHNICAL DETAILS ABOUT CRYPTOGRAPHY SOFTWARE IS ILLEGAL IN SOME PARTS OF THE WORLD. SO, WHEN YOU IMPORT THIS PACKAGE TO YOUR COUNTRY, RE-DISTRIBUTE IT FROM THERE OR EVEN JUST EMAIL TECHNICAL SUGGESTIONS OR EVEN SOURCE PATCHES TO THE AUTHOR OR OTHER PEOPLE YOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO ANY EXPORT/IMPORT AND/OR USE LAWS WHICH APPLY TO YOU. Properly count message size when performing 7-8 or 8-7 bit MIME conversions. Properly compute message priority based on size of entire message, not just header. Reset SevenBitInput to its configured value between SMTP transactions for broken clients which do not properly announce 8 bit data. Better error handling in case of very unlikely queue-id conflicts. Reset SASL connection context after a failed authentication attempt. Check Berkeley DB compile time version against run time version to make sure they match. Do not attempt AAAA IPv6 DNS lookups if IPv6 is not enabled in the kernel. When a milter adds recipients and one of them causes an error, do not ignore the other recipients. LOCAL: If mail delivery fails, do not leave behind a stale lockfile which is ignored after the lock timeout. Portability: Port for AIX 52 Thanks to Steve Hubert of University of Washington for providing access to a computer with AIX 52 setreuid2 works on OpenBSD 33 Patch from Todd C. Allow for custom definition of SMRSH_CMDDIR and SMRSH_PATH on all operating systems. |