Re: Sendmail security problem

2006-03-28 Thread Brian A. Seklecki
On Fri, 24 Mar 2006, Joachim Schipper wrote: On Fri, Mar 24, 2006 at 02:14:50PM +, Stuart Henderson wrote: On 2006/03/24 14:12, Alexander Bochmann wrote: ...on Thu, Mar 23, 2006 at 12:22:37PM +0100, Anthony Howe wrote: P gnu/usr.sbin/sendmail/libsm/refill.c P

Re: Sendmail security problem

2006-03-25 Thread Zoong PHAM
On Friday, 24 March 2006 at 14:12:44 +0100, Alexander Bochmann wrote: Replacing OpenBSDs sendmail with sendmail.org's version is a non-issue (as in just works) on any OpenBSD version which ships = 8.12. Do you mind to share the instruction of how to replace OpenBSD's sendmail with

Re: Sendmail security problem

2006-03-25 Thread Moritz Grimm
Zoong PHAM wrote: Do you mind to share the instruction of how to replace OpenBSD's sendmail with sendmail.org's 8.13.6? Just forget about that administration nightmare and go either -stable or -current. Not sure whether this warrants and errata entry (too much hype for my taste), but if it

Possible systrace evidence [Was: Re: Sendmail security problem]

2006-03-25 Thread James Strandboge
On Fri, 2006-03-24 at 14:14 +, Stuart Henderson wrote: The patch is in 3.8-stable now, and -current has 8.13.6, so people following either of these just need to update. I run sendmail under systrace (OpenBSD 3.8) and a couple of weeks ago (sometime after the exploit was initially

Re: Sendmail security problem

2006-03-24 Thread Alexey E. Suslikov
Claus Assmann wrote: On Thu, Mar 23, 2006, Alexey E. Suslikov wrote: All I know, sendmail.org says I can not patch versions below 8.13.5: That's wrong. See the 8.13.6 note: and 8.12 are availabe at our FTP site. However, note that those patches do not (cleanly) apply to versions

Re: Sendmail security problem

2006-03-24 Thread Alexander Bochmann
...on Thu, Mar 23, 2006 at 12:22:37PM +0100, Anthony Howe wrote: I installed 8.13.6 last night from the source tar ball on two machines (one is OpenBSD 3.6, the other an old Linux box). Appears to be chugging along happily. Can't speak to the specific security issue though. Replacing

Re: Sendmail security problem

2006-03-24 Thread Stuart Henderson
On 2006/03/24 14:12, Alexander Bochmann wrote: ...on Thu, Mar 23, 2006 at 12:22:37PM +0100, Anthony Howe wrote: I installed 8.13.6 last night from the source tar ball on two machines (one is OpenBSD 3.6, the other an old Linux box). Appears to be chugging along happily. Can't speak

Re: Sendmail security problem

2006-03-24 Thread Joachim Schipper
On Fri, Mar 24, 2006 at 02:14:50PM +, Stuart Henderson wrote: On 2006/03/24 14:12, Alexander Bochmann wrote: ...on Thu, Mar 23, 2006 at 12:22:37PM +0100, Anthony Howe wrote: I installed 8.13.6 last night from the source tar ball on two machines (one is OpenBSD 3.6, the other an

Re: Sendmail security problem

2006-03-24 Thread Martin Schröder
On 2006-03-24 17:10:27 +0100, Joachim Schipper wrote: On Fri, Mar 24, 2006 at 02:14:50PM +, Stuart Henderson wrote: The patch is in 3.8-stable now, and -current has 8.13.6, so people following either of these just need to update. I am pretty certain a fix was imported for 3.7-stable,

Sendmail security problem

2006-03-23 Thread Alexey E. Suslikov
Raul Aldaz wrote: Any comment about this? (see sendmail.org). All I know, sendmail.org says I can not patch versions below 8.13.5: If you cannot upgrade to 8.13.6, then you can apply a patch to 8.13.5, or a patch for 8.12.11. Note: these patches do not apply cleanly to older versions;

Re: Sendmail security problem

2006-03-23 Thread Anthony Howe
Alexey E. Suslikov wrote: Raul Aldaz wrote: Any comment about this? (see sendmail.org). So fix is currently unknown for 3.8-stable with 8.13.4. Looks like we need to wait millert@'s work for stable branches... One way to fix 3.8-stable is to pull in 8.13.6 entirely but anyway it needs

Re: Sendmail security problem

2006-03-23 Thread Claus Assmann
On Thu, Mar 23, 2006, Alexey E. Suslikov wrote: All I know, sendmail.org says I can not patch versions below 8.13.5: That's wrong. See the 8.13.6 note: and 8.12 are availabe at our FTP site. However, note that those patches do not (cleanly) apply to versions other than 8.13.5 and

Sendmail security problem

2006-03-22 Thread Raul Aldaz
Hi, Any comment about this? (see sendmail.org). Este correo electrsnico y la informacisn contenida en el mismo es de caracter confidencial y esta sometida al secreto profesional, dirigiindose exclusivamente al destinatario mencionado en el encabezamiento, cuyos datos forman parte de un