You've probably already seen the latest sendmail vulnerability. http://lists.netsys.com/pipermail/full-disclosure/2003-September/010287.html I believe you can apply the following patch to any of the security branches: http://cvsweb.freebsd.org/src/contrib/sendmail/src/parseaddr.c.diff?r1=1.1.1.17&r2=1.1.1.18 Download the patch and: # cd /usr/src # patch -p1 < /path/to/patch # cd /usr/src/usr.sbin/sendmail # make obj && make depend && make && make install Official advisory will go out later today. Cheers, -- Jacques Vidrine . NTT/Verio SME . FreeBSD UNIX . Heimdal nectar@celabo.org . jvidrine@verio.net . nectar@freebsd.org . nectar@kth.se
> -------- Original Message -------- > Subject: Sendmail vulnerability > Date: Wed, 17 Sep 2003 11:21:18 -0500 > From: Jacques A. Vidrine <nectar@freebsd.org> > To: freebsd-security@freebsd.org > > You've probably already seen the latest sendmail vulnerability. > > http://lists.netsys.com/pipermail/full-disclosure/2003-September/010287.html > > > I believe you can apply the following patch to any of the security > branches: > > http://cvsweb.freebsd.org/src/contrib/sendmail/src/parseaddr.c.diff?r1=1.1.1.17&r2=1.1.1.18 > > > Download the patch and: > > # cd /usr/src > # patch -p1 < /path/to/patch > # cd /usr/src/usr.sbin/sendmail > # make obj && make depend && make && make install > > > Official advisory will go out later today.I've tried to make that but I get this error (on a stable with today sources): .... cc -O -pipe -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/src -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/include -I. -DNEWDB -DNIS -DMILTER -DNETINET6 -DTCPWRAPPERS -DMAP_REGEX -DDNSMAP -DSTARTTLS -D_FFR_TLS_1 -c /usr/src/usr.sbin/sendmail/../../contrib/sendmail/src/util.c cc -O -pipe -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/src -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/include -I. -DNEWDB -DNIS -DMILTER -DNETINET6 -DTCPWRAPPERS -DMAP_REGEX -DDNSMAP -DSTARTTLS -D_FFR_TLS_1 -c /usr/src/usr.sbin/sendmail/../../contrib/sendmail/src/version.c cc -O -pipe -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/src -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/include -I. -DNEWDB -DNIS -DMILTER -DNETINET6 -DTCPWRAPPERS -DMAP_REGEX -DDNSMAP -DSTARTTLS -D_FFR_TLS_1 -o sendmail alias.o arpadate.o bf.o collect.o conf.o control.o convtime.o daemon.o deliver.o domain.o envelope.o err.o headers.o macro.o main.o map.o mci.o milter.o mime.o parseaddr.o queue.o readcf.o recipient.o savemail.o sasl.o sfsasl.o shmticklib.o sm_resolve.o srvrsmtp.o stab.o stats.o sysexits.o timers.o tls.o trace.o udb.o usersmtp.o util.o version.o -lutil -lwrap /usr/src/lib/libsmutil/libsmutil.a /usr/src/lib/libsm/libsm.a -lssl -lcrypto cc: /usr/src/lib/libsmutil/libsmutil.a: No such file or directory cc: /usr/src/lib/libsm/libsm.a: No such file or directory *** Error code 1 Stop in /usr/src/usr.sbin/sendmail. .... -- Marco Trentini mark@remotelab.org http://www.remotelab.org/
> > # cd /usr/src > > # patch -p1 < /path/to/patch > > # cd /usr/src/usr.sbin/sendmail > > # make obj && make depend && make && make install > > I've tried to make that but I get this error (on a stable with today > sources):If you haven't built world before, you need to also: cd /usr/src/lib/libsm make obj && make depend && make cd /usr/src/lib/libsmutil make obj && make depend && make
Looks like they have released http://www.sendmail.org/8.12.10.html
Are their plans to import/mfc this into stable ? No doubt a busy day for
the Sendmail folk as well :-(
---Mike
At 12:21 PM 17/09/2003, Jacques A. Vidrine wrote:>You've probably already seen the latest sendmail vulnerability.
>
>http://lists.netsys.com/pipermail/full-disclosure/2003-September/010287.html
>
>I believe you can apply the following patch to any of the security
>branches:
>
>http://cvsweb.freebsd.org/src/contrib/sendmail/src/parseaddr.c.diff?r1=1.1.1.17&r2=1.1.1.18
>
>Download the patch and:
>
> # cd /usr/src
> # patch -p1 < /path/to/patch
> # cd /usr/src/usr.sbin/sendmail
> # make obj && make depend && make && make install
>
>
>Official advisory will go out later today.
>
>Cheers,
>--
>Jacques Vidrine . NTT/Verio SME . FreeBSD UNIX . Heimdal
>nectar@celabo.org . jvidrine@verio.net . nectar@freebsd.org . nectar@kth.se
>_______________________________________________
>freebsd-security@freebsd.org mailing list
>http://lists.freebsd.org/mailman/listinfo/freebsd-security
>To unsubscribe, send any mail to
"freebsd-security-unsubscribe@freebsd.org"