From openpkg@openpkg.org Wed Mar 22 16:50:59 2006 From: OpenPKG To: bugtraq@securityfocus.com Date: Wed, 22 Mar 2006 19:53:40 +0100 Subject: [OpenPKG-SA-2006.007] OpenPKG Security Advisory (sendmail) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________________________________________________________ OpenPKG Security Advisory The OpenPKG Project http://www.openpkg.org/security.html http://www.openpkg.org openpkg-security@openpkg.org openpkg@openpkg.org OpenPKG-SA-2006.007 22-Mar-2006 ________________________________________________________________________ Package: sendmail Vulnerability: remote code execution OpenPKG Specific: no Affected Releases: Affected Packages: Corrected Packages: OpenPKG CURRENT <= sendmail-8.13.5-20060219 >= sendmail-8.13.6-20060322 OpenPKG 2.5 <= sendmail-8.13.5-2.5.0 >= sendmail-8.13.5-2.5.1 OpenPKG 2.4 <= sendmail-8.13.4-2.4.0 >= sendmail-8.13.4-2.4.1 OpenPKG 2.3 <= sendmail-8.13.3-2.3.0 >= sendmail-8.13.3-2.3.1 Description: According to a vendor security advisory [0] based on research by from Mark Dowd of ISS X-Force, a vulnerability exists in the Sendmail MTA [1]. Under some specific timing conditions, the vulnerability may permit a specifically crafted attack to take over the "sendmail" MTA process, allowing remote attackers to execute commands and run arbitrary programs on the system running the MTA, affecting email delivery, or tampering with other programs and data on this system. The Common Vulnerabilities and Exposures (CVE) project assigned the id CVE-2006-0058 [2] to the problem. ________________________________________________________________________ References: [0] http://www.sendmail.com/company/advisory/index.shtml [1] http://www.sendmail.org/ [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0058 ________________________________________________________________________ For security reasons, this advisory was digitally signed with the OpenPGP public key "OpenPKG " (ID 63C4CB9F) of the OpenPKG project which you can retrieve from http://pgp.openpkg.org and hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org/ for details on how to verify the integrity of this advisory. ________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Comment: OpenPKG iD8DBQFEIZ0ZgHWT4GPEy58RAq5gAKC8QqDZjjZWySX5yoLTK/F+T9WH7QCfR0Sf bHZpRrZz7O6x3c9gNVtFdFw= =UOQR -----END PGP SIGNATURE-----