| Beschreibung: | Description:
The remote host is missing an update to sendmail
announced via advisory MDKSA-2003:092.
A buffer overflow vulnerability was discovered in the address parsing
code in all versions of sendmail prior to 8.12.10 by Michal Zalewski,
with a patch to fix the problem provided by Todd C. Miller. This
vulnerability seems to be remotely exploitable on Linux systems running
on the x86 platform
the sendmail team is unsure of other platforms
(CVE-2003-0694).
Another potential buffer overflow was fixed in ruleset parsing which is
not exploitable in the default sendmail configuration. A problem may
occur if non-standard rulesets recipient (2), final (4), or mailer-
specific envelope recipients rulesets are use. This problem was
discovered by Timo Sirainen (CVE-2003-0681).
MandrakeSoft encourages all users who use sendmail to upgrade to the
provided packages which are patched to fix both problems.
Affected versions: 8.2, 9.0, 9.1, Corporate Server 2.1
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2003:092
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0681
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0694
http://www.sendmail.org/8.12.10.html
http://lists.netsys.com/pipermail/full-disclosure/2003-September/010287.html
Risk factor : Critical
CVSS Score:
10.0
|
