From owner-freebsd-security@FreeBSD.ORG  Thu Mar 23 18:31:21 2006
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id E5F8F16A401
	for <freebsd-security@freebsd.org>;
	Thu, 23 Mar 2006 18:31:21 +0000 (UTC)
	(envelope-from ca+envelope@esmtp.org)
Received: from zardoc.esmtp.org (adsl-63-195-85-27.dsl.snfc21.pacbell.net
	[63.195.85.27]) by mx1.FreeBSD.org (Postfix) with ESMTP id A0F5E43D45
	for <freebsd-security@freebsd.org>;
	Thu, 23 Mar 2006 18:31:21 +0000 (GMT)
	(envelope-from ca+envelope@esmtp.org)
Received: from zardoc.esmtp.org (localhost. [127.0.0.1])
	by zardoc.esmtp.org (sendmail X.1.0.PreAlpha3.0) with ESMTPS
	(TLS=TLSv1/SSLv3, cipher=AES256-SHA, bits=256, verify=OK)
	id S0000000000029F1900; Thu, 23 Mar 2006 10:31:20 -0800
Received: (from ca@localhost)
	by zardoc.esmtp.org (8.13.4/8.12.10.Beta0/Submit) id k2NIVKaV007866
	for freebsd-security@freebsd.org; Thu, 23 Mar 2006 10:31:20 -0800 (PST)
Date: Thu, 23 Mar 2006 10:31:20 -0800
From: Claus Assmann <freebsd+security@esmtp.org>
To: freebsd-security@freebsd.org
Message-ID: <20060323183120.GA28503@zardoc.esmtp.org>
References: <200603221611.k2MGBV8j010104@freefall.freebsd.org>
	<20060323101735.J16906@home.ephemeron.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20060323101735.J16906@home.ephemeron.org>
User-Agent: Mutt/1.5.9i
Subject: Re: FreeBSD Security Advisory FreeBSD-SA-06:13.sendmail
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 23 Mar 2006 18:31:22 -0000

On Thu, Mar 23, 2006, Bigby Findrake wrote:
> Does an attacker need network access to the machine, or does the attacker 

Yes.

> merely need to be able to get an SMTP message to the machine?

He needs to control the timeouts (AFAICT).