klieber
Bodhisattva
Joined: 17 Apr 2002
Posts: 3657
Location: San Francisco, CA
|
 Posted: Sun Oct 13, 2002 4:43 pm Post subject: [gentoo-announce] GLSA: sendmail |
 |
|
| Daniel Ahlberg wrote: | - - --------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT
- - --------------------------------------------------------------------
PACKAGE :sendmail
SUMMARY :smsrh bypass vulnerabilites
DATE :2002-10-13 14:45 UTC
- - --------------------------------------------------------------------
It is possible for an attacker to bypass the restrictions imposed by The Sendmail Consortiums Restricted Shell (SMRSH) and execute a binary of his choosing by inserting a special character sequence into his .forward file.
Read the full advisory at
http://www.sendmail.org/smrsh.adv.txt
SOLUTION
It is recommended that all Gentoo Linux users who are running net-mail/sendmail-8.12.6 and earlier update their systems as follows:
emerge rsync
emerge sendmail
emerge clean
- - --------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at www.gentoo.org/~aliz
- - -------------------------------------------------------------------- |
Mailing List Archive: http://lists.gentoo.org/pipermail/gentoo-announce/2002-October/000216.html
--kurt
_________________
The problem with political jokes is that they get elected |
|
News & Announcements
