Hi Bugtraqers, All of the downloadable versions are still buggy, and I can't understand why does it recommend the main-main-developer to paste '%s' into the source code. The following patch should work against this ugly format bug: --- accept.c.orig Tue Jun 12 11:33:01 2001 +++ accept.c Tue Jun 12 11:33:38 2001 @@ -2503,7 +2503,7 @@ nothing on success. The function moan_smtp_batch() does not return - it exits from the program with a non-zero return code. */ - else if (smtp_reply != NULL) moan_smtp_batch(NULL, smtp_reply); + else if (smtp_reply != NULL) moan_smtp_batch(NULL, "%s", smtp_reply); } /* Reset headers so that logging of rejects for a subsequent message doesn't ><sarcasm> >Why, thank you for letting Philip Hazel (who is on holiday right now) >get a patched version out before announcing this to bugtraq. ></sarcasm> At the moment, we know another 'ugly' bug in the exim main code, but because of your tone it's not published. I can't understand, why do you use this tone against people, who audits your shity code, which has some errors in it. >> /etc/exim.conf should have an option set: > >This is not the default name or location for the exim config file. >> lez:~$ /usr/sbin/exim -bS These values are defaults in most linuxes. > and no one with sense runs an MTA as root, and the exim security > information strongly suggests you do not. > > On my relays the MTA runs as root only once at boot time to bind to > port 25 and is not suid root. Yes, this looks like a real problem but > it should also serve as a good time to check that as little as > possible runs as root. On default linuxes exim is installed with setuid root. We speak about the default install. The exim main source code has lot of setuid() call, so it's developed for root usage also. -- . . _ __ ______________________________________________________ __ _ . . Foldi Tamas - We Are The Hashmark In The Rootshell - Security Consultant crowat_private - PGP: finger://crowat_private - (+3630) 221-7477
This archive was generated by hypermail 2b30 : Tue Jun 12 2001 - 10:55:11 PDT