All my border machines have special C programs that have replaced the
local and shell mailers to reject and complain about any attempt to
deliver mail locally. Will this likely keep me safe, or not?
Perry
Steven Tepper says:
> > Does anyone have more info on the sendmail vulnerability announced by
> > CERT yesterday? What's the hole? Does it only concern TCP connections
> > into sendmail? Or can forwarded mail be used to exploit it? CERT
> > hinted the former to me on the phone, but I'd like any perspectives on
> > this from someone who knows.
>
> This isn't much, but the README from Sun patch 101077-03 says:
>
> 1142888: A sendmail security hole dealing with mail delivered to files
>
> The phrase "delivered to files" sounds as if it refers to aliases
> that put the mail in a named file, e.g. "foo:/usr/adm/foolog".
References:
|
|
