--------------------------------------------------------------------------
Turbolinux Security Advisory TLSA-2002-68
http://www/turbolinux.co.jp/security/
security-team@turbolinux.co.jp
--------------------------------------------------------------------------
Sendmail
Vulnerability of smrsh
Release date : 2002-11-01
Solution: package : sendmail-8.12.6-2
Problem
* Problem with the command restriction with the smrsh of the sendmail.
Solution:
Using turbopkg command, please do automatic operation update.
When there is a necessity only, update is done automatically.
Use the following command to verify the version currently installed.
# rpm -qa | grep package name
When automatic operation update is used, those which are presently are installed update all objects.
Select the package, and use the rpm command to select when you would like to update.
Execution example
---------------------------------------------------------------------
1. In super user modification
$ su -
2. Password of super user input
Password:
3. Starting the turbopkg
# turbopkg
4. Menu selection
" Update "
" FTP server "
" Update sight "
Optional sight selection
5. In general user modification
# exit
---------------------------------------------------------------------
< Turbolinux 8 Server >
sendmail-8.12.6-2.i586.rpm
sendmail-cf-8.12.6-2.i586.rpm
sendmail-doc-8.12.6-2.i586.rpm
< Turbolinux 8 Workstation >
< Turbolinux 7 Server >
< Turbolinux 7 Workstation >
sendmail-8.11.6-9.i586.rpm
sendmail-cf-8.11.6-9.i586.rpm
sendmail-doc-8.11.6-9.i586.rpm
< Turbolinux Server 6.5 >
< Turbolinux Workstation 6.0 >
< Turbolinux Advanced Server 6 >
< Turbolinux Server 6.1 >
* This problem is not applicable to the version where our company has done release with the above-mentioned product.
* Upon the maintenance of our company FTP sight, we determined that update of the turbopkg is neccesary. Details the below-mentioned URL reference.
http://www.turbolinux.co.jp/download/zabom.html
Package updates:
http://www.turbolinux.co.jp/update/
