Fedora 22: Security Advisory for OpenSMTPD Remote Attack and DoS

OpenSMTPD is a FREE implementation of the server-side SMTP protocol as defined

by RFC 5321, with some additional standard extensions. It allows ordinary

machines to exchange e-mails with other systems speaking the SMTP protocol.

Started out of dissatisfaction with other implementations, OpenSMTPD nowadays

is a fairly complete SMTP implementation. OpenSMTPD is primarily developed

by Gilles Chehade, Eric Faurot and Charles Longeau; with contributions from

various OpenBSD hackers. OpenSMTPD is part of the OpenBSD Project.

The software is freely usable and re-usable by everyone under an ISC license.

This package uses standard "alternatives" mechanism, you may call

"/usr/sbin/alternatives --set mta /usr/sbin/sendmail.opensmtpd"

if you want to switch to OpenSMTPD MTA immediately after install, and

"/usr/sbin/alternatives --set mta /usr/sbin/sendmail.sendmail" to revert

back to Sendmail as a default mail daemon.

Issues fixed in this release (since 5.7.2): - fix an mda buffer truncation bug which allows a user to create forward files that pass session checks but fail delivery later down the chain, within the user mda; - fix remote buffer overflow in unprivileged pony process; - reworked offline enqueue to better protect against hardlink attacks. ---- Several vulnerabilities have been fixed in OpenSMTPD 5.7.2: - an oversight in the portable version of fgetln() that allows attackers to read and write out-of-bounds memory; - multiple denial-of-service vulnerabilities that allow local users to kill or hang OpenSMTPD; - a stack-based buffer overflow that allows local users to crash OpenSMTPD, or execute arbitrary code as the non-chrooted _smtpd user; - a hardlink attack (or race-conditioned symlink attack) that allows local users to unset the chflags() of arbitrary files; - a hardlink attack that allows local users to read the first line of arbitrary files (for example, root's hash fr...