X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=doc%2Fdoc-txt%2FChangeLog;h=ba8b15bfbcf19217098b2cd17902bec98670fc31;hb=c988f1f4faa9f679f79beddf3c14676c5dcb8e28;hp=3492968172686b60ec7caa562400aaf7d8b69ed7;hpb=1f5b4c3d3200be53a3a6f2bf6791b70fc543b32f;p=exim.git

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 349296817..ba8b15bfb 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -1,4 +1,4 @@
-$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.57 2004/12/22 12:05:45 ph10 Exp $
+$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.59 2004/12/29 10:55:58 ph10 Exp $
 
 Change log file for Exim from version 4.21
 -------------------------------------------
@@ -236,8 +236,8 @@ Exim version 4.50
 
 55. Some experimental protocols are using DNS PTR records for new purposes. The
     keys for these records are domain names, not reversed IP addresses. The
-    dnsdb lookup now tests whether it's key is an IP address. If not, it leaves
-    it alone. Component reversal etc. now happens only for IP addresses.
+    dnsdb PTR lookup now tests whether its key is an IP address. If not, it
+    leaves it alone. Component reversal etc. now happens only for IP addresses.
 
 56. Improve error message when ldap_search() fails in OpenLDAP or Solaris LDAP.
 
@@ -253,6 +253,25 @@ Exim version 4.50
       (2) The default for smtp_banner uses $smtp_active_hostname instead
           of $primary_hostname.
 
+60. The host_aton() function is supposed to be passed a string that is known
+    to be a valid IP address. However, in the case of IPv6 addresses, it was
+    not checking this. This is a hostage to fortune. Exim now panics and dies
+    if the condition is not met. A case was found where this could be provoked
+    from a dnsdb PTR lookup with an IPv6 address that had more than 8
+    components; fortuitously, this particular loophole had already been fixed
+    by change 4.50/55 above.
+
+    If there are any other similar loopholes, the new check in host_aton()
+    itself should stop them being exploited. The report I received stated that
+    data on the command line could provoke the exploit when Exim was running as
+    exim, but did not say which command line option was involved. All I could
+    find was the use of -be with a bad dnsdb PTR lookup, and in that case it is
+    running as the user.
+
+61. There was a buffer overflow vulnerability in the SPA authentication code
+    (which came originally from the Samba project). I have added a test to the
+    spa_base64_to_bits() function which I hope fixes it.
+
 
 Exim version 4.43
 -----------------