On 4/25/06, John Poltorak <jp at w= arpix.org> wrote:

On Mon, Apr 24, 2006 at 01:38:36PM -0700, Brendan Oakley wrote:

Whic= h security holes?

Excerpted from Sendmail release notes since 8.12.3, just the "critical= " security fixes:

8.12.8/8.12.8    2003/02/11
    SECURITY: Fix a remote buffer overflow in header parsing= by
        dropping sender and recipient header = comments if the
        comments are too long. Problem = noted by Mark Dowd
        of ISS X-Force.

8.12.9/8.12.9    2003/03/29
    SECURITY: Fix a buffer overflow in address parsing due t= o
        a char to int conversion problem whic= h is potentially
        remotely exploitable. Problem f= ound by Michal Zalewski.
        Note: an MTA that is not patch= ed might be vulnerable to
        data that it receives from untrusted = sources, which
        includes DNS.

8.12.10/8.12.10    2003/09/24 (Release: 2003/09/17)
    SECURITY: Fix a buffer overflow in address parsing. = ; Problem
        detected by Michal Zalewski, patch fr= om Todd C. Miller
        of Courtesan Consulting.

8.13.6/8.13.6    2006/03/22
    SECURITY: Replace unsafe use of setjmp(3)/longjmp(3) in = the server
        and client side of sendmail with time= outs in the libsm I/O
        layer and fix problems in that code.&= nbsp; Also fix handling of
        a buffer in sm_syslog() which could h= ave been used as an
        attack vector to exploit the unsafe h= andling of
        setjmp(3)/longjmp(3) in combination w= ith signals.
        Problem detected by Mark Dowd of ISS = X-Force.

I'm using I= BM's last Sendmail for OS/2 as my mail server and have been
doing so for= around six years. What problems are you having?

I'm not having any problems. IBM Sendmail simply is not applicable to my wo= rk, where we use the latest Sendmail.

I would be = interested in being able to use real sendmail, but building it
is rather= tricky.

Incidentally there is a new generation of sendmail in development -=
SendmailX. If anyone is interested in building sendmail on OS/2, it may= be
an idea to get involved with that on the ground floor and ensure it = builds
on OS/2 from day one rather than trying to retrofit OS/2 several years<= br>later after much hacking.

I rather wish we used Sendmail X, or anything other than Sendmail. :P

The idea of= being able to unpack the original sendmail source and run
'build' and h= ave a good chance of creating an OS/2 executable is very
appealing to me. It would be nice to see that happen.

=
Sendmail seems to be pretty portable, but abominably complex. I'll let you = know how it goes, when I get to it. Soon.

--
John<= /blockquote>

Brendan