Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 526
Alerts This Week
Warning Icon 1 526

Gentoo: GLSA-202308-15 Normal: Postfix Security Vulnerability

gentoo
Calendar Grey December 22, 2014
Scroller Gentoo
This notice pertains to a data exposure issue found in Sendmail for Gentoo. A security update is advised.
A vulnerability in sendmail could allow a local attacker to obtain sensitive information.

Summary

The sm_close_on_exec function in conf.c has arguments in the wrong order.

Topics%20covered

Topics Covered

security advisory gentoo sendmail software upgrade local attack information disclosure normal severity

Resolution

All sendmail users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=mail-mta/sendmail-8.14.9"

References

[ 1 ] CVE-2014-3956 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3956

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201412-32
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: Normal
Title: sendmail: Information disclosure
Date: December 22, 2014
Bugs: #511760
ID: 201412-32

Topics%20covered

Topics Covered

security advisory gentoo sendmail software upgrade local attack information disclosure normal severity

Synopsis

A vulnerability in sendmail could allow a local attacker to obtain sensitive information.

Background

sendmail is a widely-used Mail Transport Agent (MTA).

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 mail-mta/sendmail < 8.14.9 >= 8.14.9

Impact

===== A local attacker could get access to unintended high-numbered file descriptors via a specially crafted program.

Workaround

There is no known workaround at this time.