Stay Secure with the Latest Linux Advisories

security advisorygentoobuffer overflow

Gentoo: Advisory 202312-07 Critical: sendmail Buffer Overflow Exploit

Fix a buffer overflow in address parsing. Fix a potential buffer overflow in ruleset parsing. This problemis not exploitable in the default sendmail configuration.. - - - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200309-13 - - - --------------------------------------------------------------------- PACKAGE : sendmail SUMMARY : buffer overflows DATE : 2003-09-17 20:52 UTC EXPLOIT : remote VERSIONS AFFECTED : =sendmail-8.2.10 CVE : - - - --------------------------------------------------------------------- quote from release notes: "Fix a buffer overflow in address parsing. Problem detected by Michal Zalewski, patch from Todd C. Miller of Courtesan Consulting. Fix a potential buffer overflow in ruleset parsing. This problem is not exploitable in the default sendmail configuration; only if non-standard rulesets recipient (2), final (4), or mailer-specific envelope recipients rulesets are used then a problem may occur. Problem noted by Timo Sirainen." SOLUTION It is recommended that all Gentoo Linux users who are running net-mail/sendmail upgrade to sendmail-8.2.10 as follows: emerge sync emerge sendmail emerge clean - - - --------------------------------------------------------------------- This email address is being protected from spambots. You need JavaScript enabled to view it. - GnuPG key is available at - - - --------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQE/aMmXfT7nyhUpoZMRAoyYAJwOr62OQN3G+SXYMC5QXPuU2EjYbACcCfVL rSrMrf+lRPq9Nqh+pa18i8A=c+4s -----END PGP SIGNATURE----- . Critical notice for Gentoo users: Address the buffer overflow security flaws present in sendmail, focusing on mitigating dangers related to address parsing and ruleset processing.. Gentoo Sendmail Buffer Overflow Remote Exploit. . Severity: Critical. LinuxSecurity.com Team

Sep 17, 2003 •Critical Gentoo