Re: Fwd: [TL-Security-Announce] Sendmail-8.11.2-5 TLSA2001003-1

From: Mike Tancsa (mike@sentex.net)
Date: 02/23/01 

Date: Thu, 22 Feb 2001 20:48:58 -0500
To: Gregory Neil Shapiro <gshapiro@FreeBSD.ORG>
From: Mike Tancsa <mike@sentex.net>

At 05:39 PM 2/22/2001 -0800, Gregory Neil Shapiro wrote:
> >>>>> "mike" == Mike Tancsa <mike@sentex.net> writes:
>
>mike> Is this a LINUX specific thing, or Sendmail in general ??
>
> >> TurboLinux Advisory ID#: TLSA2001003-1
>
> >> 1. Problem Summary
> >>
> >> Sendmail, launched with the -bt command-line switch, enters its special
> >> "address test" mode. Under these conditions, it is vulnerable to a
> >> segmentation fault which can occur when trying to set a class in ad-
> >> dress test mode due to a negative array index.
>
>First, that was *fixed* in 8.11.2, not vulnerable in 8.11.2:

Thanks for the quick response! The way it was worded, it claimed all
versions of sendmail were vulnerable :-(

> >> 2. Impact
> >>
> >> A user can gain root privileges.
>
>Second, it does not give you any privileges at all, even in the version
>that has the bug. The original reporter, Michal Zalewski, even
>acknowledges this fact. I wonder where TurboLinux gets their information.

I thought this looked familiar from a while back. Thanks again for quickly
settling the issue!

         ---Mike

--------------------------------------------------------------------
Mike Tancsa, tel +1 519 651 3400
Network Administration, mike@sentex.net
Sentex Communications www.sentex.net
Cambridge, Ontario Canada www.sentex.net/mike

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: Fwd: [TL-Security-Announce] Sendmail-8.11.2-5 TLSA2001003-1
    ... mike> Is this a LINUX specific thing, or Sendmail in general ?? ... >> segmentation fault which can occur when trying to set a class in ad- ... >> A user can gain root privileges. ...
    (FreeBSD-Security)
  • Configuration help: behind linksys router
    ... I've just set up my first Linux box, ... It is providing DNS to the class ... With the private domain name, I'd like my linux hox to host sendmail ... as an inside mail server. ...
    (comp.os.linux.networking)
  • linux behind linksys - configuration of server
    ... I've just set up my first Linux box, ... however in the setup i chose to also install sendmail. ... It is providing DNS to the class ... inside mail server. ...
    (comp.os.linux.networking)
  • Re: RedHat slow boot
    ... Now I notice that the Internet in Linux ... In your sendmail configuration just make sure it states that the smpt ... * This message was composed on a 100% Microsoft free computer * ...
    (RedHat)
  • Re: Another Queue Question
    ... days with their Linux Sendmail server. ... The server is used for inbound email only and its directed to either ... The version of Sendmail is 3.0.6, this was a corporate image so I'm ... If queue is processed without porblems than start a few more ...
    (comp.mail.sendmail)