From fda9060b2f487e1b98779a2995fb11d52f0872d9 Mon Sep 17 00:00:00 2001 From: Aldas Nabazas Date: Sun, 27 Apr 2008 17:49:44 +0200 Subject: [PATCH] [dbmail] Updated (2.0.10 -> 2.2.9) : SECURITY - MEDIUM CVE-2007-6714 (Medium) : DBMail before 2.2.9, when using authldap with an LDAP server that supports anonymous login such as Active Directory, allows remote attackers to bypass authentication via an empty password, which causes the LDAP bind to indicate success based on anonymous authentication. --- mail/dbmail/dbmail.conf | 4 ++-- mail/dbmail/dbmail.desc | 7 +++---- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/mail/dbmail/dbmail.conf b/mail/dbmail/dbmail.conf index 721639db9..d20e649a0 100644 --- a/mail/dbmail/dbmail.conf +++ b/mail/dbmail/dbmail.conf @@ -1,8 +1,8 @@ - # --- SDE-COPYRIGHT-NOTE-BEGIN --- # This copyright note is auto-generated by ./scripts/Create-CopyPatch. # # Filename: package/.../dbmail/dbmail.conf +# Copyright (C) 2008 The OpenSDE Project # Copyright (C) 2004 - 2006 The T2 SDE Project # Copyright (C) 1998 - 2003 Clifford Wolf # @@ -16,7 +16,7 @@ case "${SDECFG_PKG_DBMAIL_DB}" in mysql) - var_append extraconfopt ' ' "--with-mysql=/opt/mysql/include/mysql/" + var_append extraconfopt ' ' "--with-mysql" var_append LDFLAGS ' ' "-L/opt/mysql/lib/mysql/" export LDFLAGS ;; postgresql) diff --git a/mail/dbmail/dbmail.desc b/mail/dbmail/dbmail.desc index 6ab5abf0f..36de1fbff 100644 --- a/mail/dbmail/dbmail.desc +++ b/mail/dbmail/dbmail.desc @@ -1,9 +1,8 @@ - [COPY] --- SDE-COPYRIGHT-NOTE-BEGIN --- [COPY] This copyright note is auto-generated by ./scripts/Create-CopyPatch. [COPY] [COPY] Filename: package/.../dbmail/dbmail.desc -[COPY] Copyright (C) 2006 The OpenSDE Project +[COPY] Copyright (C) 2006 - 2008 The OpenSDE Project [COPY] Copyright (C) 2004 - 2006 The T2 SDE Project [COPY] Copyright (C) 1998 - 2003 Clifford Wolf [COPY] @@ -31,9 +30,9 @@ [L] GPL [S] Stable -[V] 2.0.10 +[V] 2.2.9 [P] X -----5---9 205.100 [CV-URL] http://www.dbmail.org/index.php?page=download -[D] 3291130531 dbmail-2.0.10.tar.gz http://www.dbmail.org/download/2.0/ +[D] 2519770305 dbmail-2.2.9.tar.gz http://www.dbmail.org/download/2.2/