Your message dated Mon, 18 Apr 2005 23:25:20 +0200
with message-id <[EMAIL PROTECTED]>
and subject line exim4: Patch for 296492 introduced remotely exploitable
infinite loop (DOS)
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 11 Apr 2005 13:19:51 +0000
>From [EMAIL PROTECTED] Mon Apr 11 06:19:51 2005
Return-path: <[EMAIL PROTECTED]>
Received: from projectile.ca (pyloric.projectile.ca) [64.26.176.14]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DKypN-0007FW-00; Mon, 11 Apr 2005 06:19:45 -0700
Received: from msherman by pyloric.projectile.ca with local (Exim 4.50)
id 1DKyos-0004l4-UE
for [EMAIL PROTECTED]; Mon, 11 Apr 2005 09:19:14 -0400
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Marc Sherman <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: exim4: Patch for 296492 introduced remotely exploitable infinite loop
(DOS)
X-Mailer: reportbug 3.8
Date: Mon, 11 Apr 2005 09:19:14 -0400
Message-Id: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Package: exim4
Version: 4.50-5
Severity: grave
Tags: security sid patch
Justification: remote exploitable DOS
The patch for 296492, which is currently in sid's 4.50-5, introduced an
infinite loop which could be triggered by a remote site with
(intentionally?) misconfigured DNS.
It is discussed in:
http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20050404/msg00062.html
The patch to fix this is in:
http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20050404/msg00152.html
I'm not certain, but I think that this patch _replaces_ the patch
applied to fix 296492, rather than patching it.
I hope I've set the tags and severity for this bug correctly to indicate
that it's an RC bug that should keep 4.50-5 out of sarge, but does not
apply to 4.50-4 which is currently in sarge.
- Marc
---------------------------------------
Received: (at 304174-done) by bugs.debian.org; 18 Apr 2005 21:25:26 +0000
>From [EMAIL PROTECTED] Mon Apr 18 14:25:26 2005
Return-path: <[EMAIL PROTECTED]>
Received: from 5301d.unt0.torres.l21.ma.zugschlus.de
(torres.int.l21.ma.zugschlus.de) [217.151.83.1] (Debian-exim)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DNdkE-00084g-00; Mon, 18 Apr 2005 14:25:26 -0700
Received: from lefler.int.l21.ma.zugschlus.de ([192.168.130.38])
by torres.int.l21.ma.zugschlus.de with esmtps
(TLS-1.0:RSA_AES_256_CBC_SHA:32)
(Exim 4.50)
id 1DNdkA-0002xm-MF
for [EMAIL PROTECTED]; Mon, 18 Apr 2005 23:25:22 +0200
Received: from mh by lefler.int.l21.ma.zugschlus.de with local (Exim 4.50)
id 1DNdk9-0000TC-4T
for [EMAIL PROTECTED]; Mon, 18 Apr 2005 23:25:21 +0200
Date: Mon, 18 Apr 2005 23:25:20 +0200
From: Marc Haber <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: Re: exim4: Patch for 296492 introduced remotely exploitable infinite
loop (DOS)
Message-ID: <[EMAIL PROTECTED]>
References: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <[EMAIL PROTECTED]>
User-Agent: Mutt/1.5.9i
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-3.0 required=4.0 tests=BAYES_00 autolearn=no
version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
On Mon, Apr 11, 2005 at 09:19:14AM -0400, Marc Sherman wrote:
> The patch to fix this is in:
> http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20050404/msg00152.html
This is applied in 4.50-6. The changelog entry in 4.50-6 was written
before Marc opened this bug, and I forgot to change it. Closing the
bug manually.
Greetings
Marc
--
-----------------------------------------------------------------------------
Marc Haber | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany | lose things." Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature | How to make an American Quilt | Fax: *49 621 72739835
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
