From owner-freebsd-security@FreeBSD.ORG Mon Aug 25 13:44:12 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DDF1316A4BF for ; Mon, 25 Aug 2003 13:44:12 -0700 (PDT) Received: from gw.celabo.org (gw.celabo.org [208.42.49.153]) by mx1.FreeBSD.org (Postfix) with ESMTP id 330E143FBF for ; Mon, 25 Aug 2003 13:44:10 -0700 (PDT) (envelope-from nectar@celabo.org) Received: from madman.celabo.org (madman.celabo.org [10.0.1.111]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "madman.celabo.org", Issuer "celabo.org CA" (verified OK)) by gw.celabo.org (Postfix) with ESMTP id AC0995485D for ; Mon, 25 Aug 2003 15:44:09 -0500 (CDT) Received: by madman.celabo.org (Postfix, from userid 1001) id 38DCD6D461; Mon, 25 Aug 2003 15:44:09 -0500 (CDT) Date: Mon, 25 Aug 2003 15:44:09 -0500 From: "Jacques A. Vidrine" To: freebsd-security@FreeBSD.org Message-ID: <20030825204409.GA35646@madman.celabo.org> Mail-Followup-To: "Jacques A. Vidrine" , freebsd-security@FreeBSD.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Url: http://www.celabo.org/ User-Agent: Mutt/1.5.4i-ja.1 Subject: NOTE regarding sendmail DNS map issue X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Aug 2003 20:44:13 -0000 You may or may not have already seen: I thought I'd drop an explanatory note here until I publish an advisory. This problem has been known for some time (it was first reported in FreeBSD PR#54367). The default configuration of sendmail is unaffected, and it is unknown whether the issue is truly exploitable by any means. Nonetheless, I requested that sendmail.org publish a notice so that we (FreeBSD) could also publish an advisory and merge the fix into our security branches ``just in case''. Since they have now announced the issue, we'll take care of the advisory this week. The fix is already in Sendmail 8.12.9 and so is already in 5.1-RELEASE and later as well as 4.8-STABLE (but not 4.8-RELEASE). Also, I believe the error was introduced in Sendmail 8.12.2, and so it is not present in FreeBSD releases before 4.5-RELEASE. Cheers, -- Jacques Vidrine . NTT/Verio SME . FreeBSD UNIX . Heimdal nectar@celabo.org . jvidrine@verio.net . nectar@freebsd.org . nectar@kth.se