From owner-freebsd-security  Mon Jun 14 16:33:11 1999
Delivered-To: freebsd-security@freebsd.org
Received: from tesla.i-pi.com (tesla.i-pi.com [198.49.217.4])
	by hub.freebsd.org (Postfix) with ESMTP id EEFD114C1F
	for <security@FreeBSD.ORG>; Mon, 14 Jun 1999 16:33:08 -0700 (PDT)
	(envelope-from ingham@tesla.i-pi.com)
Received: (from ingham@localhost)
	by tesla.i-pi.com (8.9.1/8.9.1) id RAA14972;
	Mon, 14 Jun 1999 17:33:00 -0600 (MDT)
Message-ID: <19990614173259.33286@i-pi.com>
Date: Mon, 14 Jun 1999 17:32:59 -0600
From: Kenneth Ingham <ingham@i-pi.com>
To: LutzRab@omc.net
Cc: security@FreeBSD.ORG
Subject: Re: New Attack via sendmail?
References: <199906141930.VAA14403@office.omc.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.84e
In-Reply-To: <199906141930.VAA14403@office.omc.net>; from Lutz Rabing on Mon, Jun 14, 1999 at 09:30:58PM +0200
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

On Mon, Jun 14, 1999 at 09:30:58PM +0200, Lutz Rabing wrote:
> 
> I've seen some pretty strange lines in syslog of one of our webservers.
> 
> The box is running 2.2.8 with sendmail 8.9.3 and has never been out of
> swap space before, in fact it's not using swap space at all under normal
> conditions.
[log deleted]

I've seen the exact same thing on a 2.2.6 system running sendmail
8.9.1 with procmail as a local delivery agent when a really large
email message (one which was around 1/3 - 1/2 of total swap space)
was moving through.

Kenneth


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message