Sendmail Update for Mandrake
Posted on: 09/18/2003 02:34 PM
MandrakeSoft S.A. has released a security patch for Sendmail under Mandrake Linux
A buffer overflow vulnerability was discovered in the address parsing code in all versions of sendmail prior to 8.12.10 by Michal Zalewski, with a patch to fix the problem provided by Todd C. Miller. This vulnerability seems to be remotely exploitable on Linux systems running on the x86 platform; the sendmail team is unsure of other platforms (CAN-2003-0694).Read more
Another potential buffer overflow was fixed in ruleset parsing which is not exploitable in the default sendmail configuration. A problem may occur if non-standard rulesets recipient (2), final (4), or mailer- specific envelope recipients rulesets are use. This problem was discovered by Timo Sirainen (CAN-2003-0681).
MandrakeSoft encourages all users who use sendmail to upgrade to the provided packages which are patched to fix both problems.