bugtraq - Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 26 Mar 2006 00:12:02 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: Theo de Raadt <deraadt@....openbsd.org>
Cc: Martin Schulze <joey@...odrom.org>, bugtraq@...urityfocus.com
Subject: Re: SendGate: Sendmail Multiple Vulnerabilities (Race Condition DoS, Memory Jumps, Integer Overflow)

* Theo de Raadt:

> What if we ignore your procedures?  What if we say no?

You won't be told about bugs in the code you write.  It's as simple as
that.

But I don't quite understand why Gadi is so thoroughly offended by the
way how this vulnerability has been handled so far.  The patches might
be obscure, but at least there are official patches for older
versions, too.  And there is an official advisory.  It could be far
worse.  The programmers of a rather popular kernel do not publish
advisories at all, for instance.