Re: Remotely triggerable buffer overflow in OpenSMTPD

["Jason A. Donenfeld" <zx2c4 () gentoo org>]

Hi folks,

On Mon, Oct 5, 2015 at 12:38 AM, Jason A. Donenfeld <Jason () zx2c4 com> wrote:
> impact etc. There's a remotely triggerable buffer overflow in
> OpenBSD's OpenSMTPD -- the latest version, 5.7.2 -- reachable by
> sending messages with huge header lines.

Fixed downstream in Gentoo with mail-mta/opensmtpd-5.7.2_p1-r1:

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=3f8e2fe24f3ff174d8515b82607e951e054f68f6

Users are encouraged to update immediately. It's worth noting that
this vulnerability was being triggered "in the wild" - hence the
rushed disclosure etc.

Regards,
Jason

-- 
Jason A. Donenfeld
Gentoo Linux Security & Infrastructure
zx2c4 () gentoo org
www.zx2c4.com
zx2c4.com/keys/A28BEDE08F1744E16037514806C4536755758000.asc