New sendmail packages available which fix a local root exploit

An input validation error in the debugging functionality of all currently
released versions of sendmail can enable a local user to gain root
access. New packages that fix this problem are available for Red Hat Linux
5.2, 6.2, 7.0, and 7.1.

Sendmail, the low-level system for sending and receiving email for Red
Hat Linux, has an input validation flaw in part of its debugging code.
This flaw could be exploited by an attacker who already has local access
to a system and wants to gain root privileges.

Red Hat is issuing new sendmail packages that correct this flaw for all our
currently supported Red Hat Linux platforms. All users are strongly
advised to apply these fixes.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this to be an easier way to apply updates. To use Red Hat
Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

52194 - SUID sendmail allows local overflow

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0653
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1349
Bugtraq ID 3163. See http://www.securityfocus.com/bid/3163 for more
information.

Problem discovered by Cade Cairns <cairnsc@securityfocus.com>.

debug, input, local, mta, root, sendmail, smtp, validation