Greetings.

I've just finished building 1.5.2 from source, on a SPARC-5.  I started
off working from this:

ftp://ftp.NetBSD.ORG/pub/NetBSD/security/advisories/NetBSD-SA2002-006.txt.asc

Initially, i retrieved the tar balls of source, unarchived them, and then
did a cvs update as per the instructions in the above advisory.

 After "make" completed successfully, i did "make install", and then
finally:

 find / -mtime +1 > /var/tmp/older-files

...just to see what files were not updated.

The list was quite long, most of it expected (like /etc and /var), but i
wasthe only things that seemed truly odd were the sendmail binaries.

 Sendmail doesn't seem to use the two functions reported as being
vulnerable in the above advisory: getanswer() and getnetanswer(), so
perhaps this isn't critical with regards to NetBSD-SA2002-006.

 But regarding the building and installation of the stuff from the gnu
 tree, /usr/src/gnu/README says:

    The makefiles in the above hierarchy will "reach over" into the GNU
   sources (src/gnu/dist) for everything they need.


 Sendmail is in the base.tgz installation set. Shouldn't it be installed
by default with the rest of the OS (during "cd /usr/src ; make install"),
rather than requiring the builder to explicitly install it, or am i
missing something?

 -johan

/usr/bin/hoststat
/usr/bin/mailq
/usr/bin/newaliases
/usr/bin/purgestat
/bin/rmail
/usr/sbin/sendmail
/usr/libexec/sm.bin