Re: Major remote root vunerability found in sendmail

From: Renaud Deraison (deraisonat_private)
Date: Mon Mar 03 2003 - 13:01:39 PST

  • Next message: Erik Parker: "Re: Major remote root vunerability found in sendmail"

    On Mon, Mar 03, 2003 at 01:52:20PM -0600, Erik Parker wrote:
    > > That work work for all of them, one of our guys is working on a nice
    > > regex for them now, will post when its done.  Below are some of the
    > > banners we have run into before.
    > 
    > Catching HD just as he gets out of bed causes him to think 'work work 
    > work'  but I think he meant 'won\'t work'
    > 
    > So.. We came up with:
    > 
    > .*Sendmail.*(Switch\-((1\.)|(2\.(0\.|1\.[0-4])))|(\/|UCB | )([5-7]|8\.([0-9](\.|;|$)|1[01]\.|12\.[0-7](\/| |\.|\+)))).*
    > 
    
    Would not it be better to have done multiple regexes ? I'll include
    Michael's original regex in addition to yours for a short, just in
    case...
    
    
    				-- Renaud
    



    This archive was generated by hypermail 2b30 : Mon Mar 03 2003 - 13:01:29 PST