MESSAGE
DATE | 2004-09-27 |
FROM | Ruben Safir Secretary NYLXS
|
SUBJECT | Re: [hangout] (fwd) [SECURITY] [DSA 554-1] New sendmail packages fix potential open relay
|
What is sasl?
On Mon, Sep 27, 2004 at 02:35:49PM -0400, Adam Kosmin wrote: > > ----- Forwarded message from Martin Schulze ----- > > Date: Mon, 27 Sep 2004 20:01:30 +0200 (CEST) > To: Debian Security Announcements > From: Martin Schulze > Subject: [SECURITY] [DSA 554-1] New sendmail packages fix potential open relay > User-Agent: dsa-launch $Revision: 1.13 $ > Reply-To: debian-security-at-lists.debian.org > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > - -------------------------------------------------------------------------- > Debian Security Advisory DSA 554-1 security-at-debian.org > http://www.debian.org/security/ Martin Schulze > September 27th, 2004 http://www.debian.org/security/faq > - -------------------------------------------------------------------------- > > Package : sendmail > Vulnerability : pre-set password > Problem-Type : remote > Debian-specific: yes > CVE ID : CAN-2004-0833 > > Hugo Espuny discovered a problem in sendmail, a commonly used program > to deliver electronic mail. When installing "sasl-bin" to use sasl in > connection with sendmail, the sendmail configuration script use fixed > user/pass information to initialise the sasl database. Any spammer > with Debian systems knowledge could utilise such a sendmail > installation to relay spam. > > For the stable distribution (woody) this problem has been fixed in > version 8.12.3-7.1. > > For the unstable distribution (sid) this problem has been fixed in > version 8.13.1-13. > > We recommend that you upgrade your sendmail package. > > > Upgrade Instructions > - -------------------- > > wget url > will fetch the file for you > dpkg -i file.deb > will install the referenced file. > > If you are using the apt-get package manager, use the line for > sources.list as given below: > > apt-get update > will update the internal database > apt-get upgrade > will install corrected packages > > You may use an automated update by adding the resources from the > footer to the proper configuration. > > > Debian GNU/Linux 3.0 alias woody > - -------------------------------- > > Source archives: > > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1.dsc > Size/MD5 checksum: 751 f87d51444a4f2e04a59fafeb7f097bbc > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1.diff.gz > Size/MD5 checksum: 258790 c2f8dcc37edf99eada5fb65b26bb9e72 > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3.orig.tar.gz > Size/MD5 checksum: 1840401 b198b346b10b3b5afc8cb4e12c07ff4d > > Architecture independent components: > > http://security.debian.org/pool/updates/main/s/sendmail/sendmail-doc_8.12.3-7.1_all.deb > Size/MD5 checksum: 747880 2ae5775f103472f8f7941e0662786930 > > Alpha architecture: > > http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_alpha.deb > Size/MD5 checksum: 267968 69dab41dfc47d348ec7ee5603971c68b > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_alpha.deb > Size/MD5 checksum: 1109604 9f64220f46ac154f7426450478f101dc > > ARM architecture: > > http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_arm.deb > Size/MD5 checksum: 247700 6bb4396b026113ec4e12026377a18d17 > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_arm.deb > Size/MD5 checksum: 979550 718d6fb7066f753dcba7c71aa7d76ed0 > > Intel IA-32 architecture: > > http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_i386.deb > Size/MD5 checksum: 237456 111a0ee4b50eafdfdf89845dc633aa1b > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_i386.deb > Size/MD5 checksum: 918104 ad5cc37cb435ed63022ab3a16ae01f6e > > Intel IA-64 architecture: > > http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_ia64.deb > Size/MD5 checksum: 282146 360db5037b71cb5eab9015ae8292aca3 > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_ia64.deb > Size/MD5 checksum: 1332930 f25bedb4ac5beb5372a704a99dc4d2ac > > HP Precision architecture: > > http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_hppa.deb > Size/MD5 checksum: 261806 5aebadbfa1f4c5b63a97034a5bdd3b5a > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_hppa.deb > Size/MD5 checksum: 1081296 1fc96f0e94f384c4f8007358243a4e5e > > Motorola 680x0 architecture: > > http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_m68k.deb > Size/MD5 checksum: 231282 8d498605748163c67d9ff0f467e01966 > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_m68k.deb > Size/MD5 checksum: 866108 b41e130ed77f5224f80178375f25664c > > Big endian MIPS architecture: > > http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_mips.deb > Size/MD5 checksum: 255334 699b5f21580f659cd22311150bf0ba5c > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_mips.deb > Size/MD5 checksum: 1022342 2b627d3fdc4c7c9841c6d150b33c1c2a > > Little endian MIPS architecture: > > http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_mipsel.deb > Size/MD5 checksum: 255012 d2a7cf6d78b43bf701b836d0224c3b09 > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_mipsel.deb > Size/MD5 checksum: 1022760 9376daf26c909df8cfd6017861c9a423 > > PowerPC architecture: > > http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_powerpc.deb > Size/MD5 checksum: 257484 698ab817f07d5f0d2c4acce2953f1a47 > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_powerpc.deb > Size/MD5 checksum: 978892 b6ee12aaa79ac88ba86c082e76292222 > > IBM S/390 architecture: > > http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_s390.deb > Size/MD5 checksum: 242818 62ee8100f00289f61c741152055b6547 > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_s390.deb > Size/MD5 checksum: 966586 7c1eadeda33234516b07f8241cb88b9d > > Sun Sparc architecture: > > http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_sparc.deb > Size/MD5 checksum: 245470 17ff10779b02a0d5d278e2ba4221b6c6 > http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_sparc.deb > Size/MD5 checksum: 982828 f791b2399d1b7dba4ec770ab08a68e0b > > > These files will probably be moved into the stable distribution on > its next update. > > - --------------------------------------------------------------------------------- > For apt-get: deb http://security.debian.org/ stable/updates main > For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main > Mailing list: debian-security-announce-at-lists.debian.org > Package info: `apt-cache show ' and http://packages.debian.org/ > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.2.5 (GNU/Linux) > > iD8DBQFBWFV5W5ql+IAeqTIRAogmAJwMuD69yyiTzYLDYSznqZ2B6e7Z4wCfXfrB > LK6qiE4EbeeNKoV4sQrnvB8= > =HUT6 > -----END PGP SIGNATURE----- > > > -- > To UNSUBSCRIBE, email to debian-security-announce-REQUEST-at-lists.debian.org > with a subject of "unsubscribe". Trouble? Contact listmaster-at-lists.debian.org > > > > ----- End forwarded message ----- > > -- > > Adam Kosmin, RHCE, LPIC > http://windowsrefund.net > ____________________________ > NYLXS: New Yorker Free Software Users Scene > Fair Use - > because it's either fair use or useless.... > NYLXS is a trademark of NYLXS, Inc
-- __________________________ Brooklyn Linux Solutions
So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998
DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://fairuse.nylxs.com
http://www.mrbrklyn.com - Consulting http://www.inns.net <-- Happy Clients http://www.nylxs.com - Leadership Development in Free Software http://www2.mrbrklyn.com/resources - Unpublished Archive or stories and articles from around the net http://www2.mrbrklyn.com/downtown.html - See the New Downtown Brooklyn....
____________________________ NYLXS: New Yorker Free Software Users Scene Fair Use - because it's either fair use or useless.... NYLXS is a trademark of NYLXS, Inc
|
|