Aviso de seguridad de Debian

DSA-257-1 sendmail -- explotación remota

Fecha del informe:

4 de mar de 2003

Paquetes afectados:

Vulnerable:

Sí

Referencias a bases de datos de seguridad:

En el diccionario CVE de Mitre: CVE-2002-1337.
Notas y avisos de incidentes y vulnerabilidades en CERT: CA-2003-07, VU#398025.

Información adicional:

Mark Dowd, de ISS X-Force, encontró un error en las rutinas de análisis de encabezados de sendmail: se podía desbordar un búfer al encontrar direcciones con comentarios muy largos. Debido a que sendmail también analiza los encabezados al reenviar correos, esta vulnerabilidad también podía alcanzar a servidores que no retransmitieran correo.

Esto se ha corregido en la versión 8.12.8 del autor, en la versión 8.12.3-5 del paquete para Debian GNU/Linux 3.0/woody y en la versión 8.9.3-25 del paquete para Debian GNU/Linux 2.2/potato.

DSA-257-2: Los paquetes actualizados de sendmail-wide están disponibles en la versión del paquete 8.9.3+3.2W-24 para Debian 2.2 (potato) y en la versión 8.12.3+3.5Wbeta-5.2 para Debian 3.0 (woody).

Arreglado en:

Debian GNU/Linux 2.2 (potato)

Fuentes:: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.9.3-25.diff.gz; http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.9.3-25.dsc; http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.9.3.orig.tar.gz; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-24.dsc; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-24.tar.gz
alpha (DEC Alpha):: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.9.3-25_alpha.deb; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-24_alpha.deb
arm (ARM):: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.9.3-25_arm.deb; --
i386 (Intel IA-32):: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.9.3-25_i386.deb; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-24_i386.deb
m68k (Motorola 680x0):: --; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-24_m68k.deb
powerpc (PowerPC):: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.9.3-25_powerpc.deb; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-24_powerpc.deb
sparc (Sun SPARC/UltraSPARC):: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.9.3-25_sparc.deb; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.9.3+3.2W-24_sparc.deb

Debian GNU/Linux 3.0 (woody)

Fuentes:: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-5.diff.gz; http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-5.dsc; http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3.orig.tar.gz; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.2.dsc; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta.orig.tar.gz; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.2.diff.gz
Componentes independientes de la arquitectura:: http://security.debian.org/pool/updates/main/s/sendmail/sendmail-doc_8.12.3-5_all.deb
alpha (DEC Alpha):: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-5_alpha.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-5_alpha.deb; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.2_alpha.deb
arm (ARM):: --; --; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.2_arm.deb
hppa (HP PA RISC):: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-5_hppa.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-5_hppa.deb; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.2_hppa.deb
i386 (Intel IA-32):: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-5_i386.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-5_i386.deb; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.2_i386.deb
ia64 (Intel IA-64):: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-5_ia64.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-5_ia64.deb; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.2_ia64.deb
m68k (Motorola 680x0):: --; --; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.2_m68k.deb
mips (MIPS (Big Endian)):: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-5_mips.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-5_mips.deb; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.2_mips.deb
mipsel (MIPS (Little Endian)):: http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-5_mipsel.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-5_mipsel.deb; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.2_mipsel.deb
powerpc (PowerPC):: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-5_powerpc.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-5_powerpc.deb; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.2_powerpc.deb
s390 (IBM S/390):: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-5_s390.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-5_s390.deb; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.2_s390.deb
sparc (Sun SPARC/UltraSPARC):: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-5_sparc.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-5_sparc.deb; http://security.debian.org/pool/updates/main/s/sendmail-wide/sendmail-wide_8.12.3+3.5Wbeta-5.2_sparc.deb

Las sumas MD5 de los ficheros que se listan están disponibles en el aviso original. (DSA-257-2)