-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200309-13 - - - --------------------------------------------------------------------- PACKAGE : sendmail SUMMARY : buffer overflows DATE : 2003-09-17 20:52 UTC EXPLOIT : remote VERSIONS AFFECTED : <sendmail-8.2.10 FIXED VERSION : >=sendmail-8.2.10 CVE : - - - --------------------------------------------------------------------- quote from release notes: "Fix a buffer overflow in address parsing. Problem detected by Michal Zalewski, patch from Todd C. Miller of Courtesan Consulting. Fix a potential buffer overflow in ruleset parsing. This problem is not exploitable in the default sendmail configuration; only if non-standard rulesets recipient (2), final (4), or mailer-specific envelope recipients rulesets are used then a problem may occur. Problem noted by Timo Sirainen." SOLUTION It is recommended that all Gentoo Linux users who are running net-mail/sendmail upgrade to sendmail-8.2.10 as follows: emerge sync emerge sendmail emerge clean - - - --------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at http://dev.gentoo.org/~aliz - - - --------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQE/aMmXfT7nyhUpoZMRAoyYAJwOr62OQN3G+SXYMC5QXPuU2EjYbACcCfVL rSrMrf+lRPq9Nqh+pa18i8A= =c+4s -----END PGP SIGNATURE-----
