Debian Security Advisory

sendmail -- Denial of Service in Sendmail

Date Reported:
07 Dec 1999
Affected Packages:
sendmail, sendmail-wide
Vulnerable:
Yes
Security database references:
No other external database security references currently available.
More information:
The version of sendmail that was distributed with Debian GNU/Linux 2.1 has a slight problem in the code to regenerate the aliases database. Sendmail allowed any user to run sendmail with the -bi option to (re)initialize the aliases database. The user could then interrupt sendmail and leave the system with a broken aliases database.

This has been fixed by only allowing root and trusted users to regenerate the aliases database.

We recommend you upgrade your sendmail package to new version.

See the BugTraq list (1999/Nov/0313) for more information.

Fixed in:

sendmail:

Source:
http://security.debian.org/dists/slink/updates/source/sendmail_8.9.3-3slink1.diff.gz
http://security.debian.org/dists/slink/updates/source/sendmail_8.9.3-3slink1.dsc
http://security.debian.org/dists/slink/updates/source/sendmail_8.9.3.orig.tar.gz
alpha:
http://security.debian.org/dists/slink/updates/binary-alpha/sendmail_8.9.3-3slink1_alpha.deb
i386:
http://security.debian.org/dists/slink/updates/binary-i386/sendmail_8.9.3-3slink1.0.1_i386.deb
m68k:
http://security.debian.org/dists/slink/updates/binary-m68k/sendmail_8.9.3-3slink1_m68k.deb
sparc:
http://security.debian.org/dists/slink/updates/binary-sparc/sendmail_8.9.3-3slink1_sparc.deb

sendmail-wide:

Source:
http://security.debian.org/dists/slink/updates/source/sendmail-wide_8.9.3+3.2W-3slink1.diff.gz
http://security.debian.org/dists/slink/updates/source/sendmail-wide_8.9.3+3.2W-3slink1.dsc
http://security.debian.org/dists/slink/updates/source/sendmail-wide_8.9.3+3.2W.orig.tar.gz
alpha:
http://security.debian.org/dists/slink/updates/binary-alpha/sendmail-wide_8.9.3+3.2W-3slink1_alpha.deb
i386:
http://security.debian.org/dists/slink/updates/binary-i386/sendmail-wide_8.9.3+3.2W-3slink1_i386.deb
m68k:
http://security.debian.org/dists/slink/updates/binary-m68k/sendmail-wide_8.9.3+3.2W-3slink1_m68k.deb
sparc:
http://security.debian.org/dists/slink/updates/binary-sparc/sendmail-wide_8.9.3+3.2W-3slink1_sparc.deb