bugtraq - Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 24 Mar 2006 16:13:26 +0100
From: Martin Schulze <joey@...odrom.org>
To: bugtraq@...urityfocus.com
Subject: Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)

Theo de Raadt wrote:
> > Sendmail is, as we know, the most used daemon for SMTP in the world. This
> > is an International Infrastructure vulnerability and should have been
> > treated that way. It wasn't. It was handled not only poorly, but
> > irresponsibly.

The documentation is distressingly vague.

> Now, the same holds true with OpenSSH.  I'll tell you what.  If there
> is ever a security problem (again :) in OpenSSH we will disclose it
> exactly like we want, and in no other way, and quite frankly since
> noone has ever paid a cent for it's development they have nothing they
> can say about it.

Theo,

this is not about paying or not paying, it is not about owing somebody
something, but about sensible disclosure of security problems to the
world.

Sendmail has been an important part of the Internet infrastructure and
has gained a lot of honour and respect.  Many people use this piece of
software and a lot of distributors/vendors are proliferating this
software.  They do deserve better, as do the users who decide to trust
this vendor.

> Or run something else.

Maybe this is indeed the way to go.  There are several other
feature-rich mail transport agents.

Regards,

	Joey

-- 
Open source is important from a technical angle.             -- Linus Torvalds

Please always Cc to me when replying to me on the lists.