Re: Sendmail security problem

2006-03-28 Thread Brian A. Seklecki
On Fri, 24 Mar 2006, Joachim Schipper wrote: On Fri, Mar 24, 2006 at 02:14:50PM +, Stuart Henderson wrote: On 2006/03/24 14:12, Alexander Bochmann wrote: ...on Thu, Mar 23, 2006 at 12:22:37PM +0100, Anthony Howe wrote: P gnu/usr.sbin/sendmail/libsm/refill.c P gnu/usr.sbin/sendmail/sendma

Re: Sendmail security problem

2006-03-27 Thread Alexander Bochmann
...on Sat, Mar 25, 2006 at 09:22:57PM +1100, Zoong PHAM wrote: > Do you mind to share the instruction of how to replace OpenBSD's > sendmail with sendmail.org's 8.13.6? Warning: Works for me, but may not for you. The specific version below is untested, and may miss options you need on your s

Possible systrace evidence [Was: Re: Sendmail security problem]

2006-03-25 Thread James Strandboge
On Fri, 2006-03-24 at 14:14 +, Stuart Henderson wrote: > The patch is in 3.8-stable now, and -current has 8.13.6, so > people following either of these just need to update. > I run sendmail under systrace (OpenBSD 3.8) and a couple of weeks ago (sometime after the exploit was initially repor

Re: Sendmail security problem

2006-03-25 Thread Moritz Grimm
Zoong PHAM wrote: Do you mind to share the instruction of how to replace OpenBSD's sendmail with sendmail.org's 8.13.6? Just forget about that administration nightmare and go either -stable or -current. Not sure whether this warrants and errata entry (too much hype for my taste), but if it d

Re: Sendmail security problem

2006-03-25 Thread Zoong PHAM
On Friday, 24 March 2006 at 14:12:44 +0100, Alexander Bochmann wrote: > > Replacing OpenBSDs sendmail with sendmail.org's version > is a non-issue (as in "just works") on any OpenBSD version > which ships >= 8.12. Do you mind to share the instruction of how to replace OpenBSD's sendmail with

Re: Sendmail security problem

2006-03-24 Thread Martin Schröder
On 2006-03-24 17:10:27 +0100, Joachim Schipper wrote: > On Fri, Mar 24, 2006 at 02:14:50PM +, Stuart Henderson wrote: > > The patch is in 3.8-stable now, and -current has 8.13.6, so > > people following either of these just need to update. > > I am pretty certain a fix was imported for 3.7-sta

Re: Sendmail security problem

2006-03-24 Thread Joachim Schipper
On Fri, Mar 24, 2006 at 02:14:50PM +, Stuart Henderson wrote: > On 2006/03/24 14:12, Alexander Bochmann wrote: > > ...on Thu, Mar 23, 2006 at 12:22:37PM +0100, Anthony Howe wrote: > > > > > I installed 8.13.6 last night from the source tar ball on two machines > > > (one is OpenBSD 3.6, the

Re: Sendmail security problem

2006-03-24 Thread Stuart Henderson
On 2006/03/24 14:12, Alexander Bochmann wrote: > ...on Thu, Mar 23, 2006 at 12:22:37PM +0100, Anthony Howe wrote: > > > I installed 8.13.6 last night from the source tar ball on two machines > > (one is OpenBSD 3.6, the other an old Linux box). Appears to be chugging > > along happily. Can't

Re: Sendmail security problem

2006-03-24 Thread Alexander Bochmann
...on Thu, Mar 23, 2006 at 12:22:37PM +0100, Anthony Howe wrote: > I installed 8.13.6 last night from the source tar ball on two machines > (one is OpenBSD 3.6, the other an old Linux box). Appears to be chugging > along happily. Can't speak to the specific security issue though. Replacing O

Re: Sendmail security problem

2006-03-24 Thread Alexey E. Suslikov
Claus Assmann wrote: On Thu, Mar 23, 2006, Alexey E. Suslikov wrote: All I know, sendmail.org says I can not patch versions below 8.13.5: That's wrong. See the 8.13.6 note: and 8.12 are availabe at our FTP site. However, note that those patches do not (cleanly) apply to versions oth

Re: Sendmail security problem

2006-03-23 Thread Claus Assmann
On Thu, Mar 23, 2006, Alexey E. Suslikov wrote: > All I know, sendmail.org says I can not patch versions below > 8.13.5: That's wrong. See the 8.13.6 note: and 8.12 are availabe at our FTP site. However, note that those patches do not (cleanly) apply to versions other than 8.13.5 and 8.

Re: Sendmail security problem

2006-03-23 Thread Anthony Howe
Alexey E. Suslikov wrote: Raul Aldaz wrote: Any comment about this? (see sendmail.org). So fix is currently unknown for 3.8-stable with 8.13.4. Looks like we need to wait millert@'s work for stable branches... One way to fix 3.8-stable is to pull in 8.13.6 entirely but anyway it needs testi

Sendmail security problem

2006-03-23 Thread Alexey E. Suslikov
Raul Aldaz wrote: Any comment about this? (see sendmail.org). All I know, sendmail.org says I can not patch versions below 8.13.5: If you cannot upgrade to 8.13.6, then you can apply a patch to 8.13.5, or a patch for 8.12.11. Note: these patches do not apply cleanly to older versions; moreove

Sendmail security problem

2006-03-22 Thread Raul Aldaz
Hi, Any comment about this? (see sendmail.org). "Este correo electrsnico y la informacisn contenida en el mismo es de caracter confidencial y esta sometida al secreto profesional, dirigiindose exclusivamente al destinatario mencionado en el encabezamiento, cuyos datos forman parte de un fic