Sendmail vulnerability

[Marco Trentini]

> -------- Original Message --------
> Subject: Sendmail vulnerability
> Date: Wed, 17 Sep 2003 11:21:18 -0500
> From: Jacques A. Vidrine <nectar at freebsd.org>
> To: freebsd-security at freebsd.org
> 
> You've probably already seen the latest sendmail vulnerability.
> 
> http://lists.netsys.com/pipermail/full-disclosure/2003-September/010287.html 
> 
> 
> I believe you can apply the following patch to any of the security
> branches:
> 
> http://cvsweb.freebsd.org/src/contrib/sendmail/src/parseaddr.c.diff?r1=1.1.1.17&r2=1.1.1.18 
> 
> 
> Download the patch and:
> 
>   # cd /usr/src
>   # patch -p1 < /path/to/patch
>   # cd /usr/src/usr.sbin/sendmail
>   # make obj && make depend && make && make install
> 
> 
> Official advisory will go out later today.

I've tried to make that but I get this error (on a stable with today 
sources):

....
cc -O -pipe  -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/src 
-I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/include -I. -DNEWDB 
-DNIS -DMILTER -DNETINET6 -DTCPWRAPPERS -DMAP_REGEX -DDNSMAP -DSTARTTLS 
-D_FFR_TLS_1     -c 
/usr/src/usr.sbin/sendmail/../../contrib/sendmail/src/util.c
cc -O -pipe  -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/src 
-I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/include -I. -DNEWDB 
-DNIS -DMILTER -DNETINET6 -DTCPWRAPPERS -DMAP_REGEX -DDNSMAP -DSTARTTLS 
-D_FFR_TLS_1     -c 
/usr/src/usr.sbin/sendmail/../../contrib/sendmail/src/version.c
cc -O -pipe  -I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/src 
-I/usr/src/usr.sbin/sendmail/../../contrib/sendmail/include -I. -DNEWDB 
-DNIS -DMILTER -DNETINET6 -DTCPWRAPPERS -DMAP_REGEX -DDNSMAP -DSTARTTLS 
-D_FFR_TLS_1       -o sendmail alias.o arpadate.o bf.o collect.o conf.o 
control.o convtime.o daemon.o deliver.o domain.o envelope.o err.o 
headers.o macro.o main.o map.o mci.o milter.o mime.o parseaddr.o queue.o 
readcf.o recipient.o savemail.o sasl.o sfsasl.o shmticklib.o 
sm_resolve.o srvrsmtp.o stab.o stats.o sysexits.o timers.o tls.o trace.o 
udb.o usersmtp.o util.o version.o -lutil -lwrap 
/usr/src/lib/libsmutil/libsmutil.a /usr/src/lib/libsm/libsm.a -lssl 
-lcrypto
cc: /usr/src/lib/libsmutil/libsmutil.a: No such file or directory
cc: /usr/src/lib/libsm/libsm.a: No such file or directory
*** Error code 1

Stop in /usr/src/usr.sbin/sendmail.
....





-- 
Marco Trentini                mark at remotelab.org
http://www.remotelab.org/