Bug 11994

Summary:	kernel bug, sendmail problem
Product:	[Retired] Red Hat Linux	Reporter:	clau
Component:	kernel	Assignee:	Michael K. Johnson <johnsonm>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	high
Version:	6.2	CC:	bilbo, jason, redbugs
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	i386
OS:	Linux
URL:	http://www.sendmail.org/sendmail.8.10.1.LINUX-SECURITY.txt
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2000-06-15 19:09:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description clau 2000-06-08 20:16:27 UTC

There is a bug in the Linux kernel capability model for versions
through 2.2.15 that allows local users to get root.  Sendmail is
one of the programs that can be attacked this way.  This problem
may occur in other capabilities-based kernels.

(See http://www.sendmail.org/sendmail.8.10.1.LINUX-SECURITY.txt )

I wonder, when are you going to launch a new kernel RPM with the latest 
kernel and another RPM with sendmail 8.10.2  ? Sendmail.org highly 
recommends to upgrade to 8.10.2.

Nowadays I cannot upgrade to sendmail 8.10.2 (to filter spammers more 
efficiently) without actually downloading, compiling and installing the 
latest kernel, which is for me and for the average user with an average 
internet connection, overwhelming for the least.

If I can contribute with you in any way, let me know.
Many thanks

Claudio Pacciarini
clau.ar

Comment 1 redbugs 2000-06-15 19:09:48 UTC

I hope that the new kernel .rpm release will include the latest AIC driver and 
the floating-point context error fix?  Thanx, Doug!

Comment 2 Michael K. Johnson 2000-07-31 21:28:13 UTC

http://www.redhat.com/support/errata/RHSA-2000-037-05.html