Sendmail 8.12.10
Sendmail, Inc., and the Sendmail Consortium announce the availability of sendmail 8.12.10. It contains a fix for a security problem discovered by Michal Zalewski whom we thank for bringing this problem to our attention. We also want to thank Todd C. Miller for providing a patch. sendmail 8.12.10 also includes fixes for other potential problems, see the release notes below for more details. Sendmail urges all users to either upgrade to sendmail 8.12.10 or apply a patch. Remember to check the PGP signatures of patches or releases obtained via FTP or HTTP (to check the correctness of the patch in this announcement please verify the PGP signature of it). For those not running the open source version, check with your vendor for a patch.
For a complete list of changes see the release notes down below.
Note: we are aware of the fact that the release notes state 2003/09/24 as release date but that the actual release occurred on 2003/09/17. The former was the scheduled release date, the latter was required by early public disclosure.
Please send bug reports to sendmail-bugs@sendmail.org as usual. Please send security reports to sendmail-security@sendmail.org using PGP encryption.
Note: We have changed the way we digitally sign the source code distributions to simplify verification: in contrast to earlier versions two .sig files are provided, one each for the gzip'ed version and the compressed version. That is, instead of signing the tar file, we sign the compressed/gzip'ed files, so you do not need to uncompress the file before checking the signature.
This version can be found at
ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.12.10.tar.gz ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.12.10.tar.gz.sig ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.12.10.tar.Z ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.12.10.tar.Z.sig
and the usual mirror sites.
MD5 signatures:
393f5d09d462f522c8288363870b2b42 sendmail.8.12.10.tar.gz 345042839dec70f0a0b5aaeafcf3a0e3 sendmail.8.12.10.tar.gz.sig 36b2b74577a96f79c242ff036321c2ff sendmail.8.12.10.tar.Z 1b9cd61e1342207148d950feafab0f07 sendmail.8.12.10.tar.Z.sig
You either need the first two files or the third and fourth, i.e., the gzip'ed version or the compressed version and the corresponding .sig file. The PGP signature was created using the Sendmail Signing Key/2003, available on the web site or on the public key servers.
Since sendmail 8.11 and later includes hooks to cryptography, the following information from OpenSSL applies to sendmail as well.
PLEASE REMEMBER THAT EXPORT/IMPORT AND/OR USE OF STRONG CRYPTOGRAPHY SOFTWARE, PROVIDING CRYPTOGRAPHY HOOKS OR EVEN JUST COMMUNICATING TECHNICAL DETAILS ABOUT CRYPTOGRAPHY SOFTWARE IS ILLEGAL IN SOME PARTS OF THE WORLD. SO, WHEN YOU IMPORT THIS PACKAGE TO YOUR COUNTRY, RE-DISTRIBUTE IT FROM THERE OR EVEN JUST EMAIL TECHNICAL SUGGESTIONS OR EVEN SOURCE PATCHES TO THE AUTHOR OR OTHER PEOPLE YOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO ANY EXPORT/IMPORT AND/OR USE LAWS WHICH APPLY TO YOU. THE AUTHORS ARE NOT LIABLE FOR ANY VIOLATIONS YOU MAKE HERE. SO BE CAREFUL, IT IS YOUR RESPONSIBILITY.
SENDMAIL RELEASE NOTES
$Id: 8.12.10.html,v 1.2 2006/04/12 21:51:46 eric Exp $
This listing shows the version of the sendmail binary, the version of the sendmail configuration files, the date of release, and a summary of the changes in that release.
8.12.10/8.12.10 2003/09/24 (Release: 2003/09/17) SECURITY: Fix a buffer overflow in address parsing. Problem detected by Michal Zalewski, patch from Todd C. Miller of Courtesan Consulting. Fix a potential buffer overflow in ruleset parsing. This problem is not exploitable in the default sendmail configuration; only if non-standard rulesets recipient (2), final (4), or mailer-specific envelope recipients rulesets are used then a problem may occur. Problem noted by Timo Sirainen. Accept 0 (and 0/0) as valid input for set MaxMimeHeaderLength. Problem noted by Thomas Schulz. Add several checks to avoid (theoretical) buffer over/underflows. Properly count message size when performing 7->8 or 8->7 bit MIME conversions. Problem noted by Werner Wiethege. Properly compute message priority based on size of entire message, not just header. Problem noted by Axel Holscher. Reset SevenBitInput to its configured value between SMTP transactions for broken clients which do not properly announce 8 bit data. Problem noted by Stefan Roehrich. Set {addr_type} during queue runs when processing recipients. Based on patch from Arne Jansen. Better error handling in case of (very unlikely) queue-id conflicts. Perform better error recovery for address parsing, e.g., when encountering a comment that is too long. Problem noted by Tanel Kokk, Union Bank of Estonia. Add ':' to the allowed character list for bogus HELO/EHLO checking. It is used for IPv6 domain literals. Patch from Iwaizako Takahiro of FreeBit Co., Ltd. Reset SASL connection context after a failed authentication attempt. Based on patch from Rob Siemborski of CMU. Check Berkeley DB compile time version against run time version to make sure they match. Do not attempt AAAA (IPv6) DNS lookups if IPv6 is not enabled in the kernel. When a milter adds recipients and one of them causes an error, do not ignore the other recipients. Problem noted by Bart Duchesne. CONFIG: Use specified SMTP error code in mailertable entries which lack a DSN, i.e., "error:### Text". Problem noted by Craig Hunt. CONFIG: Call Local_trust_auth with the correct argument. Patch from Jerome Borsboom. CONTRIB: Better handling of temporary filenames for doublebounce.pl and expn.pl to avoid file overwrites, etc. Patches from Richard A. Nelson of Debian and Paul Szabo. MAIL.LOCAL: Fix obscure race condition that could lead to an improper mailbox truncation if close() fails after the mailbox is fsync()'ed and a new message is delivered after the close() and before the truncate(). MAIL.LOCAL: If mail delivery fails, do not leave behind a stale lockfile (which is ignored after the lock timeout). Patch from Oleg Bulyzhin of Cronyx Plus LLC. Portability: Port for AIX 5.2. Thanks to Steve Hubert of University of Washington for providing access to a computer with AIX 5.2. setreuid(2) works on OpenBSD 3.3. Patch from Todd C. Miller of Courtesan Consulting. Allow for custom definition of SMRSH_CMDDIR and SMRSH_PATH on all operating systems. Patch from Robert Harker of Harker Systems. Use strerror(3) on Linux. If this causes a problem on your Linux distribution, compile with -DHASSTRERROR=0 and tell sendmail.org about it. Added Files: devtools/OS/AIX.5.2
