[2454] in SIPB-AFS-requests
applied fix for sendmail L0pht Security Advisory
daemon@ATHENA.MIT.EDU (mhpower@MIT.EDU)
Thu Sep 12 04:37:32 1996
From: mhpower@MIT.EDU
To: star-maintainers@MIT.EDU
Date: Thu, 12 Sep 96 04:36:22 EDT
I modified the sendmail util.c buildfname function mentioned in the
recent L0pht Security Advisory to limit the number of characters
written to the buffer "buf". The method I used allows for at most 63
characters from the gecos field to be written to the "From:" header
line of mail sent from the local machine. Longer names are truncated
after the 63rd character (or at least the one 276-character name I
tried was truncated at that point). After making this change, I
rebuilt sendmail. The build tree for most of the machines is in
/afs/sipb/service/sendmail/.build/@sys/base-8.6.13/src; the special
version for bed (with syslog changes for mail to discuss) is in
/afs/sipb/service/sendmail/.build/sun4m_412.closet/base-8.6.13/src.
The old version of sendmail is in /usr/lib/sendmail.8.6.13.anygecos on
all of the affected machines (beacon, bed, charon, rtfm, www,
penguin-lust, and reynelda).
The new daemon should now be listening for connections on all of the
machines except reynelda (which doesn't allow incoming mail).
Matt
