Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• Security vulnerability in sendmail CVE-2006-4434.
  
  Use-after-free vulnerability in Sendmail before 8.13.8
  allows remote attackers to cause a denial of service
  (crash)
  via a long "header line", which causes a previously freed
  variable to be referenced.
  

Local fix

Problem summary

• Use-after-free vulnerability in Sendmail before 8.13.8
  allows remote attackers to cause a denial of service
  (crash) via a long "header line", which causes a previously
   freed variable to be referenced.
  

Problem conclusion

• set the CurEnv e_to member to 0.
  

Temporary fix

Comments

• 5300-06 - use AIX APAR IZ24183
  5300-07 - use AIX APAR IZ36350
  5300-08 - use AIX APAR IZ36339
  5300-09 - use AIX APAR IZ25563
  6100-00 - use AIX APAR IZ34749
  6100-01 - use AIX APAR IZ34389
  6100-02 - use AIX APAR IZ25577
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  IZ25563 IZ25570 IZ25577 IZ27535 IZ34389 IZ34749 IZ36339 IZ36350

Fix information

• Fixed component name

  AIX 5.3

• Fixed component ID

  5765G0300

Applicable component levels

• R530 PSY U821930

     UP08/12/11 I 1000

PTF to Fileset Mapping

• U821930 bos.net.tcp.client 5.3.0.72

IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.

Product categories:

Software

Operating System

AIX family

APARs - AIX 5.3 environment

Operating system(s):

AIX

Software version:

530

Reference #:

IZ24183

IBM Group:

IBM Server Group

Modified date:

2009-07-08