[1551] in linux-security and linux-alert archive
[linux-security] Re: Vulnerability in Elm-ME+
daemon@ATHENA.MIT.EDU (Kari E. Hurtta)
Sat May 17 17:26:22 1997
From: "Kari E. Hurtta" <Kari.Hurtta@ozone.FMI.FI>
In-Reply-To: <19970515115417.16042@happy.cs.twsu.edu> from John Goerzen at "May 15, 97 11:54:17 am"
To: jgoerzen@happy.cs.twsu.edu (John Goerzen)
Date: Sat, 17 May 1997 22:16:03 +0300 (EDT)
Cc: linux-security@redhat.com, hurtta+elm@ozone.FMI.FI
Reply-To: hurtta+elm@ozone.FMI.FI
Resent-From: linux-security@redhat.com
John Goerzen:
> Hello,
>
> I have confirmed that the recently-reported vulnerability in Elm is also
> present in Elm-ME+ and thus also in Debian GNU/Linux version 1.2, prerelease
> version 1.3, and development tree "unstable".
OK. I made fix to Elm 2.4ME+ PL32 (25)
Posted to alt.sources and comp.mail.elm with
Message-ID: <elm2.4ME+/PL32/1@ozone.FMI.FI>
Archive-name: elm2.4ME+/PL32
Available on ftp.ozone.FMI.FI
via anonymous ftp
directory KEH/
files elm-2.4ME+32.tar.gz
and elm-2.4ME+PL32.patch.gz
Also available with
<URL: http://www.ozone.FMI.FI/KEH/elm-2.4ME+32.tar.gz >
and <URL: http://www.ozone.FMI.FI/KEH/elm-2.4ME+PL32.patch.gz >
via WWW.
/ Kari Hurtta
--------------------------------------------------------------
Version Elm2.4ME+ PL0 (25) is based to version Elm2.4 PL24 ME8b+.
Version Elm2.4 PL24 ME8b+ is based to version Elm2.4 PL24 ME8b.
Version Elm2.4 PL24 ME8b is done by Michael Elkins <elkins.aero.org>.
For details, look file ANNOUNCE.ME
[ Equivalent of MIME code in Elm2.4 PL24 ME8b is posted to
Elm Development Cordinator ]
Version Elm2.4 PL24 ME8b is based to version Elm2.4 PL24.
Version Elm2.4ME+ PLx (25) includes patch of version Elm2.4 PL25.
Changes of Elm2.4ME+ PL32 (25) compared to Elm2.4ME+ PL31 (25)
---------------------------------------------------------------
- Incorrect Content-length: -header was causing corruption
of folders.
From: Guy Harris <guy@netapp.com>
- argv_from_to was not handled ',' in comments correctly.
Detected from report of Gary Casterline
<casterln@nature.Berkeley.EDU>
> Use rfc822_toklen instead of len_next_part
- SECURITY: strcpy -> strfcpy changes of Elm2.4ME+ PL29 (25)
was not done for curses.c in this source tree.
Bug report on List <BUGTRAQ@NETSPACE.ORG>.
From: John Goerzen <jgoerzen@happy.cs.twsu.edu>
- Some changes on curses.c (bl -- bell)
- Change output of option -v
- "If you use 'answer -u', then every user name is truncated to
three letters." ... "Change line 232 to: " ...
From: Jean-Pierre Radley <jpr@jpr.com>
[ Suggested fix was incorrect. ]
- "Configure always has had a problem on Linux systems,
extracting names in a usuable format (from /usr/lib/libc.so).
The following small change fixes this."
From: Bauke Jan Douma <bjdouma@xs4all.nl>
- "In Solaris enviroment NIS+ is now used instead of Yellow
Pages so I have modified Configure to reflect this and
allow to use niscat in the same fashion as ypcat was."
From: Jerzy Sobczyk <J.Sobczyk@ia.pw.edu.pl>
- Compilation of filter (actions.c) fail.
Reported by: Arnout Boer <arnoutb@xs4all.nl>
- Typo mismatch in lib/strftime.c
From: Yuval Shamir <yuvals@iil.intel.com>
- [wordwrap.c, bultin editor]
"Wordwrap and delete at the
beginning of the line does not work in PL31. Fix is below."
From: "Zoltan T. Hidvegi" <hzoli@VNET.IBM.COM>
[ I didn't used supplied patch. ]
- [builtin editor] There was 'sizeof buffer' instead of
'buffer_size' in get_with_expansion()
- Add same fflush -fix to remail.c which is in mailmsg2.c
