Debian-Sicherheitsankündigung

DSA-1155-2 sendmail -- Programmierfehler

Datum des Berichts:

24. Aug 2006

Betroffene Pakete:

Verwundbar:

Sicherheitsdatenbanken-Referenzen:

In der Debian-Fehlerdatenbank: Fehler 373801, Fehler 380258.
In der Bugtraq-Datenbank (bei SecurityFocus): BugTraq ID 18433.
In Mitres CVE-Verzeichnis: CVE-2006-1173.
CERTs Verwundbarkeiten, Hinweise und Ereignis-Notizen: VU#146718.

Weitere Informationen:

Es stellte sich heraus, dass das Programm sendmail von libsasl2 (>= 2.1.19.dfsg1) abhängt, was weder in Stable noch im Sicherheitsarchiv verfügbar ist. Diese Version ist jedoch für die Integration in die nächste Aktualisierung der stabilen Veröffentlichung vorgesehen.

Sie müssen die zu Ihrer Architektur gehörende Datei von unten herunterladen und sie mit dpkg -i installieren.

Alternativ kann das temporäre Hinzufügen der folgenden Zeile zu /etc/apt/sources.list dieses Problem abschwächen:


  deb http://ftp.debian.de/debian stable-proposed-updates main

Hier ist zur Vollständigkeit die ursprüngliche Sicherheitsankündigung:

Frank Sheiness entdeckte, dass eine MIME-Konvertierungsroutine in sendmail, einem mächtigen, effizienten und skalierbaren Mail-Transport-Agent, durch eine speziell erzeugte E-Mail ausgetrickst werden kann, eine endlose Rekursion zu starten.

Für die Stable-Distribution (Sarge) wurde dieses Problem in Version 8.13.4-3sarge2 behoben.

Für die Unstable-Distribution (Sid) wurde dieses Problem in Version 8.13.7-1 behoben.

Wir empfehlen Ihnen, Ihre sendmail-Pakete zu aktualisieren.

Behoben in:

Debian GNU/Linux 3.1 (sarge)

Quellcode:: http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.13.4-3sarge2.dsc; http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.13.4-3sarge2.diff.gz; http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.13.4.orig.tar.gz; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/cyrus-sasl2_2.1.19.dfsg1-0sarge2.dsc; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/cyrus-sasl2_2.1.19.dfsg1-0sarge2.diff.gz; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/cyrus-sasl2_2.1.19.dfsg1.orig.tar.gz
Architektur-unabhängige Dateien:: http://security.debian.org/pool/updates/main/s/sendmail/sendmail-base_8.13.4-3sarge2_all.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-cf_8.13.4-3sarge2_all.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-doc_8.13.4-3sarge2_all.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.13.4-3sarge2_all.deb
Alpha:: http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge2_alpha.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge2_alpha.deb; http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge2_alpha.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge2_alpha.deb; http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge2_alpha.deb; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/libsasl2_2.1.19.dfsg1-0sarge2_alpha.deb
AMD64:: http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge2_amd64.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge2_amd64.deb; http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge2_amd64.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge2_amd64.deb; http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge2_amd64.deb
ARM:: http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge2_arm.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge2_arm.deb; http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge2_arm.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge2_arm.deb; http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge2_arm.deb; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/libsasl2_2.1.19.dfsg1-0sarge2_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge2_i386.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge2_i386.deb; http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge2_i386.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge2_i386.deb; http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge2_i386.deb; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/libsasl2_2.1.19.dfsg1-0sarge2_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge2_ia64.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge2_ia64.deb; http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge2_ia64.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge2_ia64.deb; http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge2_ia64.deb; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/libsasl2_2.1.19.dfsg1-0sarge2_ia64.deb
HPPA:: http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge2_hppa.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge2_hppa.deb; http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge2_hppa.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge2_hppa.deb; http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge2_hppa.deb; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/libsasl2_2.1.19.dfsg1-0sarge2_hppa.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge2_m68k.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge2_m68k.deb; http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge2_m68k.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge2_m68k.deb; http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge2_m68k.deb; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/libsasl2_2.1.19.dfsg1-0sarge2_m68k.deb
Big endian MIPS:: http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge2_mips.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge2_mips.deb; http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge2_mips.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge2_mips.deb; http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge2_mips.deb; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/libsasl2_2.1.19.dfsg1-0sarge2_mips.deb
Little endian MIPS:: http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge2_mipsel.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge2_mipsel.deb; http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge2_mipsel.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge2_mipsel.deb; http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge2_mipsel.deb; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/libsasl2_2.1.19.dfsg1-0sarge2_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge2_powerpc.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge2_powerpc.deb; http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge2_powerpc.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge2_powerpc.deb; http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge2_powerpc.deb; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/libsasl2_2.1.19.dfsg1-0sarge2_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge2_s390.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge2_s390.deb; http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge2_s390.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge2_s390.deb; http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge2_s390.deb; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/libsasl2_2.1.19.dfsg1-0sarge2_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge2_sparc.deb; http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge2_sparc.deb; http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge2_sparc.deb; http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge2_sparc.deb; http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge2_sparc.deb; http://ftp.debian.org/debian/pool/main/c/cyrus-sasl2/libsasl2_2.1.19.dfsg1-0sarge2_sparc.deb

MD5-Prüfsummen der aufgeführten Dateien stehen in der ursprünglichen Sicherheitsankündigung zur Verfügung.

MD5-Prüfsummen der aufgezählten Dateien stehen in der überarbeiteten Sicherheitsankündigung zur Verfügung.