From owner-freebsd-stable@FreeBSD.ORG Wed Sep 17 10:20:28 2003 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6140916A4B3; Wed, 17 Sep 2003 10:20:28 -0700 (PDT) Received: from 194-185-53-242.f5.ngi.it (194-185-53-242.f5.ngi.it [194.185.53.242]) by mx1.FreeBSD.org (Postfix) with ESMTP id A0A3043F3F; Wed, 17 Sep 2003 10:20:26 -0700 (PDT) (envelope-from mark@remotelab.org) Received: from remotelab.org (einstein.lab [192.168.168.2]) h8HHKOTt076800; Wed, 17 Sep 2003 19:20:25 +0200 (CEST) (envelope-from mark@remotelab.org) Message-ID: <3F6897D8.5050503@remotelab.org> Date: Wed, 17 Sep 2003 19:20:24 +0200 From: Marco Trentini User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.5b) Gecko/20030723 Thunderbird/0.1 X-Accept-Language: en-us, en MIME-Version: 1.0 To: freebsd-stable@freebsd.org References: <3F688BD4.2030305@remotelab.org> In-Reply-To: <3F688BD4.2030305@remotelab.org> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: freebsd-security@freebsd.org cc: varie@gufi.org Subject: Re: Sendmail vulnerability X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 17 Sep 2003 17:20:28 -0000 > -------- Original Message -------- > Subject: Sendmail vulnerability > Date: Wed, 17 Sep 2003 11:21:18 -0500 > From: Jacques A. Vidrine > To: freebsd-security@freebsd.org > > You've probably already seen the latest sendmail vulnerability. > > http://lists.netsys.com/pipermail/full-disclosure/2003-September/010287.html > > > I believe you can apply the following patch to any of the security > branches: > > http://cvsweb.freebsd.org/src/contrib/sendmail/src/parseaddr.c.diff?r1=1.1.1.17&r2=1.1.1.18 > > > Download the patch and: > > # cd /usr/src > # patch -p1 < /path/to/patch > # cd /usr/src/usr.sbin/sendmail > # make obj && make depend && make && make install > > > Official advisory will go out later today. I've tried to make that but I get this error (on a stable with today sources): .... cc -O -pipe -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/src -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/include -I. -DNEWDB -DNIS -DMILTER -DNETINET6 -DTCPWRAPPERS -DMAP_REGEX -DDNSMAP -DSTARTTLS -D_FFR_TLS_1 -c /usr/src/usr.sbin/sendmail/../../contrib/sendmail/src/util.c cc -O -pipe -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/src -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/include -I. -DNEWDB -DNIS -DMILTER -DNETINET6 -DTCPWRAPPERS -DMAP_REGEX -DDNSMAP -DSTARTTLS -D_FFR_TLS_1 -c /usr/src/usr.sbin/sendmail/../../contrib/sendmail/src/version.c cc -O -pipe -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/src -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/include -I. -DNEWDB -DNIS -DMILTER -DNETINET6 -DTCPWRAPPERS -DMAP_REGEX -DDNSMAP -DSTARTTLS -D_FFR_TLS_1 -o sendmail alias.o arpadate.o bf.o collect.o conf.o control.o convtime.o daemon.o deliver.o domain.o envelope.o err.o headers.o macro.o main.o map.o mci.o milter.o mime.o parseaddr.o queue.o readcf.o recipient.o savemail.o sasl.o sfsasl.o shmticklib.o sm_resolve.o srvrsmtp.o stab.o stats.o sysexits.o timers.o tls.o trace.o udb.o usersmtp.o util.o version.o -lutil -lwrap /usr/src/lib/libsmutil/libsmutil.a /usr/src/lib/libsm/libsm.a -lssl -lcrypto cc: /usr/src/lib/libsmutil/libsmutil.a: No such file or directory cc: /usr/src/lib/libsm/libsm.a: No such file or directory *** Error code 1 Stop in /usr/src/usr.sbin/sendmail. .... -- Marco Trentini mark@remotelab.org http://www.remotelab.org/