Re: Sendmail Patch

[email protected] wrote:
> Is the Sendmail patch (8.12.8) on the RH website
> the most current? The Sendmail.org site has the most
> current as 8.12.10.
> 
> Does the RH patch rpm of 8.12.8 include the latest
> sendmail problem? I noticed the build date was
> Sept 17 2003, lists two recent bug fixes, but doesn't
> describe them, just gives the ref#, and sendmail.org
> site doesn't xref the ref# to problem.

Yes, it is the most recent.  Here is a the information from the advisory:

-----
Michal Zalewski found a bug in the prescan() function of unpatched Sendmail
versions prior to 8.12.10. The sucessful exploitation of this bug can lead
to heap and stack structure overflows.  Although no exploit currently
exists, this issue is locally exploitable and may also be remotely
exploitable. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2003-0694 to this issue.

Additionally, for Red Hat Linux 8.0 and 9 we have included a fix for a
potential buffer overflow in ruleset parsing.  This problem is not
exploitable in the default sendmail configuration; it is exploitable only
if non-standard rulesets recipient (2), final (4), or mailer-specific
envelope recipients rulesets are used.  The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2003-0681 to
this issue.

All users are advised to update to these erratum packages containing a
backported patch which corrects these vulnerabilities.
-----

Notice the last paragraph, which talks about the backported patch.

Forrest
--