Bugtraq mailing list archives
Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)
From: Gadi Evron <ge () linuxbox org>
Date: Fri, 24 Mar 2006 11:56:33 -0600 (CST)
On Thu, 23 Mar 2006, Claus Assmann wrote:
Ask ISS about the exploit. It definitely is a programming bug, just read the man page for setjmp() on an OpenBSD system.
I did, ISS indeed enlightened me. Didn't I ask for just that? :)
It took Sendmail a mounth to fix this. A mounth.No. It took sendmail a week to fix this. The rest of the time was used to coordinate the release with all the involved vendors etc.
There are a few choices, full disclosure and "responsible disclosure" are some. You can't do both. Releasing it out of nowhere, obfuscated in very ineffective way, isn't it. Not when it's critical infrastructure. With critical internet infrastructure you need to be a tad bit smarter than that. Oh well, until the next sendmail vuln. Gadi.
Current thread:
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow), (continued)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Pim van Riezen (Mar 27)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Florian Weimer (Mar 27)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Casper . Dik (Mar 28)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Gadi Evron (Mar 24)
- RE: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Michael A Fusaro II (Mar 25)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Casper . Dik (Mar 25)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Theo de Raadt (Mar 24)
- Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow) Gadi Evron (Mar 24)