Sendmail fix for old Postfix releases

[email protected] (Wietse Venema) Thu, 6 Mar 2003 13:50:48 -0500 (EST)

Newsgroups	gmane.mail.postfix.announce
Message-ID	<20030306185048.8056CBC06F__9863.50034731931$1046976687@spike.porcupine.org>

CERT advisory CA-2003-07 describes a remote vulnerability in Sendmail
versions before 8.12.8. Postfix is not vulnerable to this problem.

The following patches have been tested with the past official
releases Postfix 1.1.12 and Postfix 1.0.8 (postfix-20010228-pl08).

The patches duplicate the fix that is implemented by Sendmail
version 8.12.8, in order to protect vulnerable Sendmail systems
against remote attack.

The fix truncates non-address information in message address headers
(comments, etc.) to 250 characters per address. This will not affect
ordinary email. However, SPAM from poorly written software can
trigger warnings.

ftp://ftp.porcupine.org/mirrors/official:

     3295 Mar  6 13:26 postfix-1.1-CA-2003-07.gz
      152 Mar  6 13:28 postfix-1.1-CA-2003-07.gz.sig
     3117 Mar  6 13:26 postfix-20010228-CA-2003-07.gz
      152 Mar  6 13:28 postfix-20010228-CA-2003-07.gz.sig

Soon to appear on the download sites listed at http://www.postfix.org/

	Wietse