Full Disclosure mailing list archives
Re: FreeBSD Security Advisory FreeBSD-SA-03:11.sendmail
From: Stephen Clowater <steve () stevesworld hopto org>
Date: Wed, 27 Aug 2003 04:59:22 -0300
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 You know there have been far to many sendmail exploits when you get to the end of reading one and your first thought is "at least It wasnt a remote root" On August 26, 2003 01:43 pm, FreeBSD Security Advisories wrote:
=========================================================================== == FreeBSD-SA-03:11.sendmail Security Advisory The FreeBSD Project Topic: sendmail DNS map problem Category: contrib Module: contrib_sendmail Announced: 2003-08-26 Credits: Oleg Bulyzhin <oleg () rinet ru> Affects: 4.6-RELEASE (up to -p16), 4.7-RELEASE (up to -p13), 4.8-RELEASE (up to -p3), 5.0-RELEASE (up to -p11) 4-STABLE prior to Mar 29 19:33:18 2003 UTC Corrected: 2003-08-25 22:33:14 UTC (RELENG_5_0) 2003-08-25 22:35:23 UTC (RELENG_4_8) 2003-08-25 22:36:10 UTC (RELENG_4_7) 2003-08-25 22:38:53 UTC (RELENG_4_6) FreeBSD only: NO For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:http://www.freebsd.org/security/>. I. Background FreeBSD includes sendmail(8), a general purpose internetwork mail routing facility, as the default Mail Transfer Agent (MTA). II. Problem Description Some versions of sendmail (8.12.0 through 8.12.8) contain a programming error in the code that implements DNS maps. A malformed DNS reply packet may cause sendmail to call `free()' on an uninitialized pointer. NOTE: The default sendmail configuration in FreeBSD does not utilize DNS maps. III. Impact Calling `free()' on an uninitialized pointer may result in a sendmail child process crashing. It may also be possible for an attacker to somehow influence the value of the `uninitialized pointer' and cause an arbitrary memory trunk to be freed. This could further lead to some other exploitable vulnerability, although no such cases are known at this time. IV. Workaround Do not use DNS maps. V. Solution Do one of the following: 1) Upgrade your vulnerable system to 4-STABLE, 5.1-RELEASE, or to the RELENG_5_1, RELENG_4_8, or RELENG_4_7 security branch dated after the correction date (5.1-RELEASE-p11, 4.8-RELEASE-p4, or 4.7-RELEASE-p14, respectively). 2) To patch your present system: The following patch has been verified to apply to FreeBSD 5.0, 4.8, 4.7, and 4.6 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-03:11/sendmail.patch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-03:11/sendmail.patch.asc b) Execute the following commands as root: # cd /usr/src # patch < /path/to/patch # cd /usr/src/lib/libsm # make obj && make depend && make # cd /usr/src/lib/libsmutil # make obj && make depend && make # cd /usr/src/usr.sbin/sendmail # make obj && make depend && make && make install c) Restart sendmail. Execute the following command as root. # /bin/sh /etc/rc.sendmail restart VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Path Revision Branch ------------------------------------------------------------------------- src/UPDATING RELENG_5_0 1.229.2.17 RELENG_4_8 1.73.2.80.2.6 RELENG_4_7 1.73.2.74.2.17 RELENG_4_6 1.73.2.68.2.45 src/sys/conf/newvers.sh RELENG_5_0 1.48.2.12 RELENG_4_8 1.44.2.29.2.5 RELENG_4_7 1.44.2.26.2.16 RELENG_4_6 1.44.2.23.2.34 src/contrib/sendmail/src/sm_resolve.c RELENG_5_0 1.1.1.4.2.1 RELENG_4_8 1.1.1.1.2.2.4.1 RELENG_4_7 1.1.1.1.2.2.2.1 RELENG_4_6 1.1.1.1.2.1.2.2 ------------------------------------------------------------------------- VII. References <URL:http://www.sendmail.org/dnsmap1.html> <URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0688> _______________________________________________ freebsd-security-notifications () freebsd org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security-notifications To unsubscribe, send any mail to "freebsd-security-notifications-unsubscribe () freebsd org" _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
- -- - - ****************************************************************************** Stephen Clowater /earth: file system full. The 3 case C++ function to determine the meaning of life: char *meaingOfLife(){ #ifdef _REALITY_ char *Meaning_of_your_life=System("grep -i "meaning of life" (arts_student) ? /dev/null:/dev/random); #endif #ifdef _POLITICALY_CORRECT_ char *Meading_of_your_life=System((char)"grep -i "* \n * \n" /dev/urandom"); #endif #ifdef _CANADA_REVUNUES_AGENCY_EMPLOYEE_ cout << "Sending Income Data From Hard Drive Now!\n"; System("dd if=/dev/urandom of=/dev/hda"); #endif return Meaning_of_your_life; } ***************************************************************************** -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQE/TGTacyHa6bMWAzYRAtmPAJ9fIT+6lvJqIxXh2YZXRhTYQO2fBQCgt2LJ xTPEUJGtjgz9tcg1fJmjd7s= =tgA2 -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- FreeBSD Security Advisory FreeBSD-SA-03:11.sendmail FreeBSD Security Advisories (Aug 26)
- Re: FreeBSD Security Advisory FreeBSD-SA-03:11.sendmail Stephen Clowater (Aug 27)
- <Possible follow-ups>
- RE: FreeBSD Security Advisory FreeBSD-SA-03:11.sendmail Schmehl, Paul L (Aug 27)