Sendmail vulnerability

[Jacques A. Vidrine]

You've probably already seen the latest sendmail vulnerability.

http://lists.netsys.com/pipermail/full-disclosure/2003-September/010287.html

I believe you can apply the following patch to any of the security
branches:

http://cvsweb.freebsd.org/src/contrib/sendmail/src/parseaddr.c.diff?r1=1.1.1.17&r2=1.1.1.18

Download the patch and:

  # cd /usr/src
  # patch -p1 < /path/to/patch
  # cd /usr/src/usr.sbin/sendmail
  # make obj && make depend && make && make install


Official advisory will go out later today.

Cheers,
-- 
Jacques Vidrine   . NTT/Verio SME      . FreeBSD UNIX       . Heimdal
nectar at celabo.org . jvidrine at verio.net . nectar at freebsd.org . nectar at kth.se