Login
Newsletter
Werbung

Sicherheit: Denial of Service in sendmail
Aktuelle Meldungen Distributionen
Name: Denial of Service in sendmail
ID: SSA:2006-166-01
Distribution: Slackware
Plattformen: Slackware -current, Slackware 8.1, Slackware 9.0, Slackware 9.1, Slackware 10.0, Slackware 10.1, Slackware 10.2
Datum: Do, 15. Juni 2006, 10:51
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1173
Applikationen: Sendmail

Originalnachricht


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security] sendmail (SSA:2006-166-01)

New sendmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0,
10.1, 10.2, and -current to fix a possible denial-of-service issue.

Sendmail's complete advisory may be found here:
http://www.sendmail.com/security/advisories/SA-200605-01.txt.asc

Sendmail has also provided an FAQ about this issue:
http://www.sendmail.com/security/advisories/SA-200605-01/faq.shtml

The CVE entry for this issue may be found here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1173


Here are the details from the Slackware 10.2 ChangeLog:
+--------------------------+
patches/packages/sendmail-8.13.7-i486-1_slack10.2.tgz:
Upgraded to sendmail-8.13.7.
Fixes a potential denial of service problem caused by excessive recursion
leading to stack exhaustion when attempting delivery of a malformed MIME
message. This crashes sendmail's queue processing daemon, which in turn
can lead to two problems: depending on the settings, these crashed
processes may create coredumps which could fill a drive partition; and
such a malformed message in the queue will cause queue processing to
cease when the message is reached, causing messages that are later in
the queue to not be processed.
Sendmail's complete advisory may be found here:
http://www.sendmail.com/security/advisories/SA-200605-01.txt.asc
Sendmail has also provided an FAQ about this issue:
http://www.sendmail.com/security/advisories/SA-200605-01/faq.shtml
The CVE entry for this issue may be found here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1173
(* Security fix *)
patches/packages/sendmail-cf-8.13.7-noarch-1_slack10.2.tgz:
Upgraded to sendmail-8.13.7 configs.
+--------------------------+


Where to find the new packages:
+-----------------------------+

Updated packages for Slackware 8.1:
sendmail-8.13.7-i386-1_slack8.1.tgz
sendmail-cf-8.13.7-noarch-1_slack8.1.tgz

Updated packages for Slackware 9.0:
sendmail-8.13.7-i386-1_slack9.0.tgz
sendmail-cf-8.13.7-noarch-1_slack9.0.tgz

Updated packages for Slackware 9.1:
sendmail-8.13.7-i486-1_slack9.1.tgz
sendmail-cf-8.13.7-noarch-1_slack9.1.tgz

Updated packages for Slackware 10.0:
sendmail-8.13.7-i486-1_slack10.0.tgz
sendmail-cf-8.13.7-noarch-1_slack10.0.tgz

Updated packages for Slackware 10.1:
sendmail-8.13.7-i486-1_slack10.1.tgz
sendmail-cf-8.13.7-noarch-1_slack10.1.tgz

Updated packages for Slackware 10.2:
sendmail-8.13.7-i486-1_slack10.2.tgz
sendmail-cf-8.13.7-noarch-1_slack10.2.tgz

Updated packages for Slackware -current:
sendmail-8.13.7-i486-1.tgz
sendmail-cf-8.13.7-noarch-1.tgz


MD5 signatures:
+-------------+

Slackware 8.1 packages:
1c3e9dd9e154e005bdf7201304e7c687 sendmail-8.13.7-i386-1_slack8.1.tgz
ef1bd1755097153511686c084227c6be sendmail-cf-8.13.7-noarch-1_slack8.1.tgz

Slackware 9.0 packages:
8795f9012db34b3e36468bce07787bb3 sendmail-8.13.7-i386-1_slack9.0.tgz
257eecb0d4f7a38a1e54463dc76e869a sendmail-cf-8.13.7-noarch-1_slack9.0.tgz

Slackware 9.1 packages:
99edd1f4fd42b7becbf884df5b3d5119 sendmail-8.13.7-i486-1_slack9.1.tgz
ee1234ed4335cadc62456274b55b9143 sendmail-cf-8.13.7-noarch-1_slack9.1.tgz

Slackware 10.0 packages:
9b767acf3043e59799395097253c1d06 sendmail-8.13.7-i486-1_slack10.0.tgz
0fc5cb4b0f1e313dd1f6b7a9be617459 sendmail-cf-8.13.7-noarch-1_slack10.0.tgz

Slackware 10.1 packages:
a7ff6c75a3319f1a9dbbac2c5fe48327 sendmail-8.13.7-i486-1_slack10.1.tgz
5fe8d1f221732dbca518771fb7497bc0 sendmail-cf-8.13.7-noarch-1_slack10.1.tgz

Slackware 10.2 packages:
0ef5d85e5026212fb528b10c3ab89155 sendmail-8.13.7-i486-1_slack10.2.tgz
05bbc5ccfb5d56b1742bf9ea888b2218 sendmail-cf-8.13.7-noarch-1_slack10.2.tgz

Slackware -current packages:
cf7c76831ad25065d1bc2a39decb1da3 sendmail-8.13.7-i486-1.tgz
c14deab3e9f4229137eeb430c4120c78 sendmail-cf-8.13.7-noarch-1.tgz


Installation instructions:
+------------------------+

Upgrade the packages as root:
# upgradepkg sendmail-8.13.7-i486-1.tgz sendmail-cf-8.13.7-noarch-1.tgz

Restart sendmail:
# . /etc/rc.d/rc.sendmail restart


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.7 (GNU/Linux)

iD8DBQFEkQn7akRjwEAQIjMRAhOZAJ4+R9blQm1Tl/IrjumpDD2E/F5DPQCdGVHp
ff6WKgy4L+IKHP5BgyBMcxw=
=9+29
-----END PGP SIGNATURE-----
Pro-Linux
Gewinnspiel
Neue Nachrichten
Werbung