Date: Tue, 26 Aug 2003 19:36:57 +0100 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: Adam Mazza <adam@68e.com> Cc: "questions@freebsd.org" <questions@freebsd.org> Subject: Re: FreeBSD-SA-03:11.sendmail Message-ID: <20030826183657.GB16046@happy-idiot-talk.infracaninophile.co.uk> In-Reply-To: <Pine.NEB.4.56.0308261237580.23996@panix3.panix.com> References: <Pine.NEB.4.56.0308260941440.19198@panix3.panix.com> <20030826153700.GA89321@happy-idiot-talk.infracaninophile.co.uk> <Pine.NEB.4.56.0308261237580.23996@panix3.panix.com>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --] On Tue, Aug 26, 2003 at 12:39:13PM -0400, Adam Mazza wrote: > > Thanks for the response. I went ahead and am running P4 but my sendmail > version didn't actually change, it's still 8.12.8p1 does the fix not > upgrade to 8.12.9 The advisory has since come out on freebsd-announce@... FreeBSD-SA-03:11.sendmail is on the FTP site at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-03:11.sendmail.asc and the link on the website front page will appear Real Soon Now. If you look at http://www.freebsd.org/cgi/cvsweb.cgi/src/contrib/sendmail/src/?sortby=date&only_with_tag=RELENG_4_8#dirlist you'll see that the fix requires a minimal patch to the file sm_resolve.c: =================================================================== RCS file: /usr/local/www/cvsroot/FreeBSD/src/contrib/sendmail/src/sm_resolve.c,v retrieving revision 1.1.1.1.2.2 retrieving revision 1.1.1.1.2.2.4.1 diff -u -p -r1.1.1.1.2.2 -r1.1.1.1.2.2.4.1 --- src/contrib/sendmail/src/sm_resolve.c 2002/06/27 20:43:24 1.1.1.1.2.2 +++ src/contrib/sendmail/src/sm_resolve.c 2003/08/25 22:35:23 1.1.1.1.2.2.4.1 @@ -233,6 +233,7 @@ parse_dns_reply(data, len) dns_free_data(r); return NULL; } + memset(*rr, 0, sizeof(**rr)); (*rr)->rr_domain = sm_strdup(host); if ((*rr)->rr_domain == NULL) { This has been applied to all of the code branches mentioned in the advisory, but only STABLE (RELENG_4) and CURRENT (HEAD) got the full import of sendmail-8.12.9, which contains other, non-security related, fixes as well. Cheers, Matthew -- Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (FreeBSD) iD8DBQE/S6jJdtESqEQa7a0RAi/XAJ419XGeZyd7diyL9Qh9808UKSELoACbB3Nz M4tNese3vrCk1qVevHkJdF4= =czn9 -----END PGP SIGNATURE-----help
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030826183657.GB16046>