Subject: CVS commit: pkgsrc/mail/sendmail
From: Adrian Portelli
Date: 2006-03-22 20:56:37
Message id: 20060322195637.4DB882DA27@cvs.netbsd.org

Log Message:
Update sendmail to address the current security issue
Bump to nb2
This will change the internal version of sendmail to 8.13.5.20060308
> 	SECURITY: Replace unsafe use of setjmp(3)/longjmp(3) in the server
> 		and client side of sendmail with timeouts in the libsm I/O
> 		layer and fix problems in that code.  Also fix handling of
> 		a buffer in sm_syslog() which could have been used as an
> 		attack vector to exploit the unsafe handling of
> 		setjmp(3)/longjmp(3) in combination with signals.
> 		Problem detected by Mark Dowd of ISS X-Force.
> 	Handle theoretical integer overflows that could triggered if
> 		the server accepted headers larger than the maximum
> 		(signed) integer value.  This is prevented in the default
> 		configuration by restricting the size of a header, and on
> 		most machines memory allocations would fail before reaching
> 		those values.  Problems found by Phil Brass of ISS.

Files:
RevisionActionfile
1.84modifypkgsrc/mail/sendmail/Makefile
1.32modifypkgsrc/mail/sendmail/Makefile.common
1.27modifypkgsrc/mail/sendmail/distinfo