Subject: CVS commit: pkgsrc/mail/sendmail812
To: None <pkgsrc-changes@NetBSD.org>
From: Todd Vierling <email@example.com>
Date: 03/22/2006 21:19:06
Module Name: pkgsrc
Committed By: tv
Date: Wed Mar 22 21:19:06 UTC 2006
pkgsrc/mail/sendmail812: Makefile Makefile.common distinfo
Update sendmail (with vendor patch) to address the current security issue:
Bump to nb2.
This will change the internal version of sendmail to 18.104.22.16860308.
> SECURITY: Replace unsafe use of setjmp(3)/longjmp(3) in the server
> and client side of sendmail with timeouts in the libsm I/O
> layer and fix problems in that code. Also fix handling of
> a buffer in sm_syslog() which could have been used as an
> attack vector to exploit the unsafe handling of
> setjmp(3)/longjmp(3) in combination with signals.
> Problem detected by Mark Dowd of ISS X-Force.
> Handle theoretical integer overflows that could triggered if
> the server accepted headers larger than the maximum
> (signed) integer value. This is prevented in the default
> configuration by restricting the size of a header, and on
> most machines memory allocations would fail before reaching
> those values. Problems found by Phil Brass of ISS.
To generate a diff of this commit:
cvs rdiff -r1.7 -r1.8 pkgsrc/mail/sendmail812/Makefile
cvs rdiff -r1.9 -r1.10 pkgsrc/mail/sendmail812/Makefile.common
cvs rdiff -r1.3 -r1.4 pkgsrc/mail/sendmail812/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.