Bug 58332 - [MAINTAINER] [SECURITY] mail/lmtpd: update to 0.9.9
Summary: [MAINTAINER] [SECURITY] mail/lmtpd: update to 0.9.9
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: Sergei Kolobov
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2003-10-21 14:50 UTC by Xavier Beaudouin
Modified: 2009-01-14 20:37 UTC (History)
0 users

See Also:


Attachments
lmtpd-0.9.9.patch (3.72 KB, patch)
2003-10-21 14:50 UTC, Xavier Beaudouin
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Xavier Beaudouin 2003-10-21 14:50:15 UTC
- Update to 0.9.9

 Change log for lmtp 0.9.9 :

  * add av.clamd.mbox_format configuration variable
    to check if mail for clamav shall be send in mbox format
    (for clamav 0.60)

  * add av.action configuration command to define an action
    to do when a command is found. Action can be 'drop', don't check
    for virus (default) of send a notification. Notification are
    formated according a file (see txt/virus.fr.txt for a french
    example)

  * when a virus is detected, set default user bounce message
    according the virus name.

  * add av.virus.keeper configuration variable. It set an mailbox
    who will catch all detected virus.

  * add lmtpsend.sh, a dummy LMTP client for tesing purpose only.

  * add sample mail with eicar virus in attachement in samples/

  * when a virus is found, antivirus log line print the time spend for
    scanning with the virus name.

  * fix: use spamassassin.acl even with 'a' scalar variable

  * fix: rfc2047 decoding skip illegal characters instead of looping
    and doen't crash on illegal charset (potential deny of service)

  * av.check.all doesn't check for virus when the mail will be delayed.

- Fix a security problem introduced by lmtpd 0.9.8 :

  RFC 2047 header decoding has 2 flaws on lmtpd 0.9.8

  o when illegal character is in the decoded sequence, it doesn't
   notice and loop. It could take a big amount of CPU usage before
   timeout.

  o on unrecognized character set, lmtpd crash.

  On both cases, the LMTP client should delay the mail and send it again
  later.

  It appear only for users who has set filter on decoded headers
  (like ~Subject: /foobar/)


NOTE: this ports depends of libhome 0.7.1 so please add pr ports/58331 before this one.

Generated with FreeBSD Port Tools 0.26
Comment 1 Sergei Kolobov freebsd_committer freebsd_triage 2003-10-22 10:52:42 UTC
Responsible Changed
From-To: freebsd-ports-bugs->sergei

I'll take it.
Comment 2 Sergei Kolobov freebsd_committer freebsd_triage 2003-10-25 23:26:31 UTC
State Changed
From-To: open->feedback

Sent update patch with minor modifications to the submitter for approval.
Comment 3 Sergei Kolobov freebsd_committer freebsd_triage 2003-10-26 21:49:57 UTC
State Changed
From-To: feedback->closed

Committed, thanks!