Notified: August 26, 2003 Updated: August 26, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: August 26, 2003
Affected
Please see the vendor statement for [VU#993452] at: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:11.sendmail.asc
The vendor has not provided us with any further information regarding this vulnerability.
Text of statement for [VU#993452] follows: [Note: Section V.1 below should read as follows: 1) Upgrade your vulnerable system to 4-STABLE, 5.1-RELEASE, or to the
RELENG_5_1, RELENG_4_8, or RELENG_4_7 security branch dated after the
correction date (5.1-RELEASE-p2, 4.8-RELEASE-p4, or 4.7-RELEASE-p14,
respectively).] -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1 FreeBSD-SA-03:11.sendmail Security Advisory
The FreeBSD Project Topic: sendmail DNS map problem Category: contrib
Module: contrib_sendmail
Announced: 2003-08-26
Credits: Oleg Bulyzhin
Updated: August 26, 2003
Affected
Please see the vendor statement for [VU#993452] at: http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:086
The vendor has not provided us with any further information regarding this vulnerability.
Text of statement for [VU#993452] follows: -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1 Mandrake Linux Security Update Advisory Package name: sendmail
Advisory ID: MDKSA-2003:086
Date: August 26th, 2003 Affected versions: 8.2, 9.0, Corporate Server 2.1 Problem Description: A vulnerability was discovered in all 8.12.x versions of sendmail up to
and including 8.12.8. Due to wrong initialization of RESOURCE_RECORD_T
structures, if sendmail receives a bad DNS reply it will call free() on
random addresses which usually causes sendmail to crash. These updated packages are patched to fix the problem. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0688
http://www.sendmail.org/dnsmap1.html
http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/54367 Updated Packages: Corporate Server 2.1: 06f312efc82a853bef8f244f0a7d62b6 corporate/2.1/RPMS/sendmail-8.12.6-3.4mdk.i586.rpm
6159dd74781b4e12ba2d9cb8c74cebc5 corporate/2.1/RPMS/sendmail-cf-8.12.6-3.4mdk.i586.rpm
0947b751f4934fe29f32eb02670640ee corporate/2.1/RPMS/sendmail-devel-8.12.6-3.4mdk.i586.rpm
9b768e4a330cc0cd6cdebd1470953247 corporate/2.1/RPMS/sendmail-doc-8.12.6-3.4mdk.i586.rpm
8458487a8e2a69b3648896e342eb4c1a corporate/2.1/SRPMS/sendmail-8.12.6-3.4mdk.src.rpm Corporate Server 2.1/x86_64: 04d7ce56ad6b62339622ae6e030234ed x86_64/corporate/2.1/RPMS/sendmail-8.12.6-3.4mdk.x86_64.rpm
4b64a8056a3499e1d36ac1de72bc8c7e x86_64/corporate/2.1/RPMS/sendmail-cf-8.12.6-3.4mdk.x86_64.rpm
5e2ac30e590d3985c8de9ced5178d875 x86_64/corporate/2.1/RPMS/sendmail-devel-8.12.6-3.4mdk.x86_64.rpm
aabddfe03a3a0fb88082c0311b318738 x86_64/corporate/2.1/RPMS/sendmail-doc-8.12.6-3.4mdk.x86_64.rpm
8458487a8e2a69b3648896e342eb4c1a x86_64/corporate/2.1/SRPMS/sendmail-8.12.6-3.4mdk.src.rpm Mandrake Linux 8.2: 2039013cc832600fe00c8c16f04e167f 8.2/RPMS/sendmail-8.12.1-4.4mdk.i586.rpm
a628b53c10b173ad6b56ec818411e4a8 8.2/RPMS/sendmail-cf-8.12.1-4.4mdk.i586.rpm
41b1161434cab61b55bbda169949a980 8.2/RPMS/sendmail-devel-8.12.1-4.4mdk.i586.rpm
d7d9e039cb3265ad955ce1401d97ca98 8.2/RPMS/sendmail-doc-8.12.1-4.4mdk.i586.rpm
7340654c00efcb2d64149cc946e1ea3b 8.2/SRPMS/sendmail-8.12.1-4.4mdk.src.rpm Mandrake Linux 8.2/PPC: 552617df801abbb743ea19f08efe9cd5 ppc/8.2/RPMS/sendmail-8.12.1-4.4mdk.ppc.rpm
634cf389d9b6d3782d52d6b4a9a06862 ppc/8.2/RPMS/sendmail-cf-8.12.1-4.4mdk.ppc.rpm
4e5fdd49f36c8263f9f8d4a5405beb27 ppc/8.2/RPMS/sendmail-devel-8.12.1-4.4mdk.ppc.rpm
320c1c788abf30b8fbafc6b6fff8ad6f ppc/8.2/RPMS/sendmail-doc-8.12.1-4.4mdk.ppc.rpm
7340654c00efcb2d64149cc946e1ea3b ppc/8.2/SRPMS/sendmail-8.12.1-4.4mdk.src.rpm Mandrake Linux 9.0: 06f312efc82a853bef8f244f0a7d62b6 9.0/RPMS/sendmail-8.12.6-3.4mdk.i586.rpm
6159dd74781b4e12ba2d9cb8c74cebc5 9.0/RPMS/sendmail-cf-8.12.6-3.4mdk.i586.rpm
0947b751f4934fe29f32eb02670640ee 9.0/RPMS/sendmail-devel-8.12.6-3.4mdk.i586.rpm
9b768e4a330cc0cd6cdebd1470953247 9.0/RPMS/sendmail-doc-8.12.6-3.4mdk.i586.rpm
8458487a8e2a69b3648896e342eb4c1a 9.0/SRPMS/sendmail-8.12.6-3.4mdk.src.rpm Bug IDs fixed (see https://qa.mandrakesoft.com for more information): To upgrade automatically, use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you. A list of FTP mirrors can be obtained from: http://www.mandrakesecure.net/en/ftp.php All packages are signed by MandrakeSoft for security. You can obtain
the GPG public key of the Mandrake Linux Security Team by executing: gpg --recv-keys --keyserver www.mandrakesecure.net 0x22458A98 Please be aware that sometimes it takes the mirrors a few hours to
update. You can view other update advisories for Mandrake Linux at: http://www.mandrakesecure.net/en/advisories/ MandrakeSoft has several security-related mailing list services that
anyone can subscribe to. Information on these lists can be obtained by
visiting: http://www.mandrakesecure.net/en/mlist.php If you want to report vulnerabilities, please contact security_linux-mandrake.com Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
Updated: August 25, 2003
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: August 28, 2003
Affected
Please see the vendor statement for [VU#993452] at: http://www.openbsd.org/errata32.html#sendmail3
The vendor has not provided us with any further information regarding this vulnerability.
Text of statement for [VU#993452] follows: There is a potential problem in the sendmail 8.12 series with respect to DNS maps in sendmail 8.12.8 and earlier sendmail 8.12.x versions. The bug did not exist in versions before 8.12 as the DNS map type is new to 8.12. The bug was fixed in 8.12.9, released March 29, 2003 but not labeled as a security fix as it wasn't believed to be a security bug at the time. Note that only FEATURE(`enhdnsbl') uses a DNS map. We do not have an assessment whether this problem is exploitable but we want to inform you just in case you distribute sendmail 8.12.x versions before 8.12.9. OpenBSD 3.2 shipped with sendmail 8.12.8 and thus has the bug. OpenBSD 3.3 shipped with sendmail 8.12.9 and does *not* have the bug. The problem has been fixed in the OpenBSD 3.2-stable branch. In addition, a patch is available for OpenBSD 3.2: ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.2/common/016_sendmail.patch Please note that this only affects sendmail configurations that use the "enhdnsbl" feature. The default OpenBSD sendmail config does *not* use this. Unless you have created a custom config that uses enhdnsbl, you do not need to apply the patch or update sendmail.
Updated: August 28, 2003
Affected
Please see the vendor statement for [VU#993452] at: http://www.openpkg.org/security/OpenPKG-SA-2003.037-sendmail.html
The vendor has not provided us with any further information regarding this vulnerability.
Text of statement for [VU#993452] follows: -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1 OpenPKG Security Advisory The OpenPKG Project
http://www.openpkg.org/security.html http://www.openpkg.org
openpkg-security@openpkg.org openpkg@openpkg.org
OpenPKG-SA-2003.037 28-Aug-2003 Package: sendmail
Vulnerability: Denial of Service
OpenPKG Specific: no Affected Releases: Affected Packages: Corrected Packages: OpenPKG CURRENT none N.A. OpenPKG 1.3 none N.A. OpenPKG 1.2 <= sendmail-8.12.7-1.2.2 >= sendmail-8.12.7-1.2.3 Dependent Packages: none Description: Oleg Bulyzhin reported to FreeBSD [1] a confirmed [2] Denial of
Service (DoS) vulnerability in all version of the Sendmail MTA [0]
earlier than 8.12.9. Due to a wrong initialization of an internal
structure, if Sendmail gets a bad DNS reply (with actual reply size
not equal the announced reply size), it later calls free() on a random
address. This usually cause Sendmail to crash. Please check whether you are affected by running "
Updated: August 25, 2003
Affected
Please see the vendor statement for [VU#993452] at: http://www.sendmail.org/dnsmap1.html
The vendor has not provided us with any further information regarding this vulnerability.
Text of statement for [VU#993452] follows: DNS map problem in 8.12.x before 8.12.9 There is a potential problem in sendmail 8.12.8 and earlier sendmail 8.12.x versions with respect to DNS maps. The bug did not exist in versions before 8.12 as the DNS map type is new to 8.12. The bug was fixed in 8.12.9, released March 29, 2003 but not labeled as a security fix as it wasn't believed to be a security bug: Properly initialize data structure for dns maps to avoid various errors, e.g., looping processes. Problem noted by Maurice Makaay of InterNLnet B.V. Note that only FEATURE(`enhdnsbl') uses a DNS map. We do not have an assessment whether this problem is exploitable, however, if you use a DNS map and an 8.12 version older than 8.12.9, then either upgrade (strongly recommended) or apply the trivial patch given below. This problem has been reported to FreeBSD by Oleg Bulyzhin, see Here's a quote from the report: Fix Use sm_resolve.c coming with sendmail 8.12.9 or use this patch: --- sm_resolve.c.orig Fri Jun 28 00:43:24 2002 +++ sm_resolve.c Thu Jul 10 01:21:17 2003 @@ -233,6 +233,7 @@ dns_free_data(r); return NULL; + memset(*rr, 0, sizeof(**rr)); (*rr) ->rr_domain = sm_strdup(host); if ((*rr)->rr_domain == NULL)
Updated: August 25, 2003
Affected
Please see the vendor statement for [VU#993452] at: ftp://patches.sgi.com/support/free/security/advisories/20030803-01-P
The vendor has not provided us with any further information regarding this vulnerability.
Text of statement for [VU#993452] follows: -----BEGIN PGP SIGNED MESSAGE----- SGI Security Advisory Title : Sendmail DNS Map Vulnerability
Number : 20030803-01-P
Date : August 25, 2003
Reference: CVE CAN-2003-0688
Reference: SGI BUG 898396
Fixed in : IRIX 6.5.22 or patch 5287 SGI provides this information freely to the SGI user community for its
consideration, interpretation, implementation and use. SGI recommends that
this information be acted upon as soon as possible. SGI provides the information in this Security Advisory on an "AS-IS" basis
only, and disclaims all warranties with respect thereto, express, implied
or otherwise, including, without limitation, any warranty of merchantability
or fitness for a particular purpose. In no event shall SGI be liable for
any loss of profits, loss of business, loss of data or for any indirect,
special, exemplary, incidental or consequential damages of any kind arising
from your use of, failure to use or improper use of any of the instructions
or information in this Security Advisory. - --- Issue Specifics --- It's been reported by sendmail.org that there is a potential problem in the
sendmail 8.12 series with respect to DNS maps in sendmail 8.12.8 and earlier
sendmail 8.12.x versions: http://www.sendmail.org/dnsmap1.html SGI ships sendmail 8.12.5 with IRIX 6.5.19 and later. The bug did not exist
in versions before 8.12 as the DNS map type is new to 8.12.x versions. This bug could potentially be exploited to cause a Denial of Service. There may be a possibility of using it to gain remote root access. The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2003-0688 to this issue: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0688 SGI has investigated the issue and recommends the following steps for
neutralizing the exposure. It is HIGHLY RECOMMENDED that these measures be
implemented on ALL vulnerable SGI systems. These issues have been corrected in patches and in future releases of IRIX. - --- Impact --- The sendmail binary is installed by default on IRIX 6.5 systems as part of
eoe.sw.base. To determine the version of IRIX you are running, execute the following
command: # /bin/uname -R That will return a result similar to the following: # 6.5 6.5.19f The first number ("6.5") is the release name, the second ("6.5.16f" in this
case) is the extended release name. The extended release name is the
"version" we refer to throughout this document. - --- Temporary Workaround --- There is no effective workaround available for these problems if you use dns
maps with sendmail. SGI recommends either upgrading to IRIX 6.5.22 (when
available), or installing the appropriate patch from the listing below. - --- Solution --- SGI has provided a series of patches for these vulnerabilities. Our
recommendation is to upgrade to IRIX 6.5.22 (when available), or install the
appropriate patch. OS Version Vulnerable? Patch # Other Actions IRIX 3.x unknown Note 1
IRIX 4.x unknown Note 1
IRIX 5.x unknown Note 1
IRIX 6.0.x unknown Note 1
IRIX 6.1 unknown Note 1
IRIX 6.2 unknown Note 1
IRIX 6.3 unknown Note 1
IRIX 6.4 unknown Note 1
IRIX 6.5 no
IRIX 6.5.1 no
IRIX 6.5.2 no
IRIX 6.5.3 no
IRIX 6.5.4 no
IRIX 6.5.5 no
IRIX 6.5.6 no
IRIX 6.5.7 no
IRIX 6.5.8 no
IRIX 6.5.9 no
IRIX 6.5.10 no
IRIX 6.5.11 no
IRIX 6.5.12 no
IRIX 6.5.13 no
IRIX 6.5.14 no
IRIX 6.5.15 no
IRIX 6.5.16 no
IRIX 6.5.17 no
IRIX 6.5.18 no
IRIX 6.5.19 yes 5287 Notes 2 & 3
IRIX 6.5.20 yes 5287 Notes 2 & 3
IRIX 6.5.21 yes 5287 Notes 2 & 3
IRIX 6.5.22 no NOTES 1) This version of the IRIX operating has been retired. Upgrade to an
actively supported IRIX operating system. See
http://support.sgi.com for more information. 2) If you have not received an IRIX 6.5.X CD for IRIX 6.5, contact your
SGI Support Provider or URL: http://support.sgi.com 3) Upgrade to IRIX 6.5.22 (when available) or install the patch. ##### Patch File Checksums ####
Filename: README.patch.5287
Algorithm #1 (sum -r): 03461 10 README.patch.5287
Algorithm #2 (sum): 38994 10 README.patch.5287
MD5 checksum: 727E74B176D101AA4DE1E5F816E86AF2 Filename: patchSG0005287
Algorithm #1 (sum -r): 39412 4 patchSG0005287
Algorithm #2 (sum): 5197 4 patchSG0005287
MD5 checksum: 6A69EEF8FC02D549D110A64F8DEDA98C Filename: patchSG0005287.eoe_src
Algorithm #1 (sum -r): 18481 378 patchSG0005287.eoe_src
Algorithm #2 (sum): 2432 378 patchSG0005287.eoe_src
MD5 checksum: EBDE27E3AF773E0EA6D2884A88501B71 Filename: patchSG0005287.eoe_sw
Algorithm #1 (sum -r): 34932 1104 patchSG0005287.eoe_sw
Algorithm #2 (sum): 48296 1104 patchSG0005287.eoe_sw
MD5 checksum: 0DE3B5C3BE9FE1DE0E0F022BB2FCDF14 Filename: patchSG0005287.idb
Algorithm #1 (sum -r): 56703 4 patchSG0005287.idb
Algorithm #2 (sum): 23907 4 patchSG0005287.idb
MD5 checksum: 6A25934457046F7EDFD84A9CE39C9623 - --- Acknowledgments ---- SGI wishes to thank sendmail.org and the users of the Internet Community at
large for their assistance in this matter. - --- Links --- SGI Security Advisories can be found at: http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/advisories/ SGI Security Patches can be found at: http://www.sgi.com/support/security/ and
ftp://patches.sgi.com/support/free/security/patches/ SGI patches for IRIX can be found at the following patch servers: http://support.sgi.com/ and ftp://patches.sgi.com/ SGI freeware updates for IRIX can be found at: http://freeware.sgi.com/ SGI patches and RPMs for Linux can be found at: http://support.sgi.com SGI patches for Windows NT or 2000 can be found at: http://support.sgi.com/ IRIX 5.2-6.4 Recommended/Required Patch Sets can be found at: http://support.sgi.com/ and ftp://patches.sgi.com/support/patchset/ IRIX 6.5 Maintenance Release Streams can be found at: http://support.sgi.com/ IRIX 6.5 Software Update CDs can be obtained from: http://support.sgi.com/ The primary SGI anonymous FTP site for security advisories and patches is
patches.sgi.com. Security advisories and patches are located under the URL
ftp://patches.sgi.com/support/free/security/ For security and patch management reasons, ftp.sgi.com (mirrors
patches.sgi.com security FTP repository) lags behind and does not do a
real-time update. - --- SGI Security Information/Contacts --- If there are questions about this document, email can be sent to
security-info@sgi.com. ------oOo------ SGI provides security information and patches for use by the entire SGI
community. This information is freely available to any person needing the
information and is available via anonymous FTP and the Web. The primary SGI anonymous FTP site for security advisories and patches is
patches.sgi.com. Security advisories and patches are located under the URL
ftp://patches.sgi.com/support/free/security/ The SGI Security Headquarters Web page is accessible at the URL: http://www.sgi.com/support/security/ For issues with the patches on the FTP sites, email can be sent to
security-info@sgi.com. For assistance obtaining or working with security patches, please
contact your SGI support provider. ------oOo------ SGI provides a free security mailing list service called wiretap and
encourages interested parties to self-subscribe to receive (via email) all
SGI Security Advisories when they are released. Subscribing to the mailing
list can be done via the Web
(http://www.sgi.com/support/security/wiretap.html) or by sending email to
SGI as outlined below. % mail wiretap-request@sgi.com
subscribe wiretap
Updated: August 26, 2003
Affected
Please see the vendor statement for [VU#993452] at: http://www.suse.com/de/security/
The vendor has not provided us with any further information regarding this vulnerability.
Text of statement for [VU#993452] follows: -----BEGIN PGP SIGNED MESSAGE----- SuSE Security Announcement Package: sendmail
Announcement-ID: SuSE-SA:2003:035
Date: Tuesday, Aug 26th 2003 19:00 MEST
Affected products: 8.0, 8.1, 8.2
SuSE Linux Enterprise Server 8
remote denial-of-service
Severity (1-10): 5
SuSE default package: no
Cross References: CAN-2003-0688 Content of this advisory: 1) security vulnerability resolved: calling free() with arbitrary
argument
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds: - traceroute(-nanog)
- gdm2
- pam_smb
- exim
3) standard appendix (further information) 1) problem description, brief discussion, solution, upgrade information The well known and widely used MTA sendmail is vulnerable to a
remote denial-of-service attack in version 8.12.8 and earlier (but not
before 8.12). The bug exists in the DNS map code. This feature is
enabled by specifying FEATURE(`enhdnsbl'). When sendmail receives an invalid DNS response it tries to call free(3)
on random data which results in a process crash. After your system was updated you have to restart your sendmail daemon
to make the update effective. There is no known workaround for this vulnerability other than using a
different MTA. Please download the update package for your distribution and verify its
integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply
the update. Our maintenance customers are being notified individually. The packages
are being offered to install from the maintenance web. Intel i386 Platform: SuSE-8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/sendmail-8.12.7-73.i586.rpm
eaf90e49886f496b2779107f1d9a831a
patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/sendmail-8.12.7-73.i586.patch.rpm
c5999fe4026e05c4308249a7e3dbf8f4
source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/sendmail-8.12.7-73.src.rpm
2cda6c535a3be4e26c50373bd078b4c7 SuSE-8.1: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/sendmail-8.12.6-147.i586.rpm
03d2b6e1083f863dc19a28f44256b071
patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/sendmail-8.12.6-147.i586.patch.rpm
ee6a3553396432bd3a208d355dacdd33
source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/sendmail-8.12.6-147.src.rpm
97417cee623251c6cc3009c13c5b1fbe SuSE-8.0: ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/sendmail-8.12.3-76.i386.rpm
c7cd791bdbcf0c5ed80cd9aab0ccc965
patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/sendmail-8.12.3-76.i386.patch.rpm
a2d04f73894a09b9134f0f516c385d78
source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/sendmail-8.12.3-76.src.rpm
4c059b5714ba2dbe5860654622b65bfb Intel i386 Platform: SuSE-8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/uucp-1.06.1-931.i586.rpm
1d5e50aea21f2ce88277fd9113dfb6da
patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/uucp-1.06.1-931.i586.patch.rpm
402cff9f2e0e4b56b2409082d0adbc0d
source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/sendmail-8.12.7-73.src.rpm
2cda6c535a3be4e26c50373bd078b4c7 SuSE-8.1: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/uucp-1.06.1-931.i586.rpm
7de06e8f16800359e25b5d9dcc739af5
patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/uucp-1.06.1-931.i586.patch.rpm
67c84d8cd4ff132ef0c1a91ed845b5d8
source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/sendmail-8.12.6-147.src.rpm
97417cee623251c6cc3009c13c5b1fbe SuSE-8.0: ftp://ftp.suse.com/pub/suse/i386/update/8.0/n4/uucp-1.06.1-931.i386.rpm
b95b64d0c474ee7b37a82e2fc04e72b7
patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/n4/uucp-1.06.1-931.i386.patch.rpm
e872341553634848bb19b0d89a1e3a37
source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/sendmail-8.12.3-76.src.rpm
4c059b5714ba2dbe5860654622b65bfb 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - traceroute(-nanog)
A integer overflow in traceroute can be abused by local attackers
to gain access to a raw IP socket. New packages are available on out FTP servers. - gdm2
Due to a bug in GDM it is possible for local users to read any text
file on a system by creating a symlink from ~/.xsession-errors. Updated packages will be available on our FTP servers soon. - pam_smb
A buffer overflow in the password handling function of pam_smb
allows remote root compromise. Fixed packages will be available soon. - exim
Two bugs where fixed in exim. One bug allows remote access as user
mail/mail and the other one allows local root access for 'Admin Users'. Fixed packages are available on our FTP servers. 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command
md5sum