bugtraq - Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.21.0603241153460.31564-100000@linuxbox.org>
Date: Fri, 24 Mar 2006 11:56:33 -0600 (CST)
From: Gadi Evron <ge@...uxbox.org>
To: Claus Assmann <ca+bugtraq@...doc.endmail.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS,
 Memory Jumps, Integer Overflow)

On Thu, 23 Mar 2006, Claus Assmann wrote:
> Ask ISS about the exploit. It definitely is a programming bug,
> just read the man page for setjmp() on an OpenBSD system.

I did, ISS indeed enlightened me. Didn't I ask for just that?
:)

> > It took Sendmail a mounth to fix this. A mounth.
> 
> No. It took sendmail a week to fix this.  The rest of the time was
> used to coordinate the release with all the involved vendors etc.

There are a few choices, full disclosure and "responsible disclosure" are
some. You can't do both. Releasing it out of nowhere, obfuscated in very
ineffective way, isn't it.

Not when it's critical infrastructure. With critical internet
infrastructure you need to be a tad bit smarter than that.

Oh well, until the next sendmail vuln.

	Gadi.