From: Gregory Neil Shapiro

-----BEGIN PGP SIGNED MESSAGE-----

Sendmail 8.9.3 is now released.

The only major change since 8.9.2 is a fix for the headers denial of
service attack posted to BugTraq.  Note that the fix included in 8.9.3 is
different from the fix posted on January 20th to BugTraq.  The fix limits
the maximum amount of memory for headers to 32 kilobytes.  If you wish to
change this value, you can compile sendmail with -D_FFR_MAX_HEADERS_LENGTH
and set the MaxHeadersLength option in the sendmail.cf file.

For example, in your BuildTools/Site/site.config.m4 file, add:

APPENDDEF(`confENVDEF', `-D_FFR_MAX_HEADERS_LENGTH=1')

and add the following to your .mc file:

define(confMAX_HEADERS_LENGTH, 16384)

The release is available from:

ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.9.3.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.9.3.tar.Z
ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.9.3.tar.sig

with MD5 signatures:

efedacfbce84a71d1cfb0e617b84596e sendmail.8.9.3.tar.gz
fdb4651bd40341efb6f530d32715a743 sendmail.8.9.3.tar.Z
dad2ae1678ea774d04ae82b6ba50e3e8 sendmail.8.9.3.tar.sig

You only need one of the first two files (either the gzip'ed version or the
compressed version).  The last file is a PGP signature of the tar file
(after uncompressing it).  It is signed with the Sendmail Signing Key/1999,
available on the web site (http://www.sendmail.org/) or in the public
key servers.  (N.B.  This is a new signing key; it has been countersigned
by the 1998 key.)

For your convenience, the complete release notes for 8.9.3 are included
below.

8.9.3/8.9.3	99/02/04
	SECURITY: Limit message headers to a maximum of 32K bytes (total
		of all headers in a single message) to prevent a denial of
		service attack.  This limit will be configurable in 8.10.
		Problem noted by Michal Zalewski of the "Internet for
		Schools" project (IdS).
	Prevent segmentation fault on an LDAP lookup if the LDAP map
		was closed due to an earlier failure.  Problem noted by
		Jeff Wasilko of smoe.org.  Fix from Booker Bense of
		Stanford University and Per Hedeland of Ericsson.
	Preserve the order of the MIME headers in multipart messages
		when performing the MIME header length check.  This
		will allow PGP signatures to function properly.  Problem
		noted by Lars Hecking of University College, Cork, Ireland.
	If ruleset 5 rewrote the local address to an :include: directive,
		the delivery would fail with an "aliasing/forwarding loop
		broken" error.  Problem noted by Eric C Hagberg of Morgan
		Stanley.  Fix from Per Hedeland of Ericsson.
	Allow -T to work for bestmx maps.  Fix from Aaron Schrab of
		ExecPC Internet Systems.
	During the transfer of a message in an SMTP transaction, if a
		TCP timeout occurs, the message would be properly queued
		for later retry but the failure would be logged as
		"Illegal Seek" instead of a timeout.  Problem noted by
		Piotr Kucharski of the Warsaw School of Economics (SGH)
		and Carles Xavier Munyoz Baldo of CTV Internet.
	Prevent multiple deliveries on a self-referencing alias if the
		F=w mailer flag is not set.  Problem noted by Murray S.
		Kucherawy of Concentric Network Corporation and Per
		Hedeland of Ericsson.
	Do not strip empty headers but if there is no value and a
		default is defined in sendmail.cf, use the default.
		Problem noted by Philip Guenther of Gustavus Adolphus
		College and Christopher McCrory of Netus, Inc.
	Don't inherit information about the sender (notably the full name)
		in SMTP (-bs) mode, since this might be called from inetd.
	Accept any 3xx reply code in response to DATA command instead of
		requiring 354.  This change will match the wording to be
		published in the updated SMTP specification from the DRUMS
		group of the IETF.
	Portability:
		AIX 4.2.0.2 ships with a /usr/lib/libbind.a which should
			not be used.  It conflicts with the resolver
			built into libc.a.  "bind" has been removed
			from the confLIBSEARCH BuildTools variable.
			Users who have installed BIND 8.X will have
			to add it back in their site.config.m4 file.
			Problem noted by Ole Holm Nielsen of the
			Technical University of Denmark.
		CRAY TS 10.0.x from Sven Nielsen of San Diego
			Supercomputer Center.
		Improved LDAP version 3 integration based on input
			from Kurt D. Zeilenga of the OpenLDAP Foundation,
			John Beck of Sun Microsystems, and Booker Bense
			of Stanford University.
		Linux doesn't have a standard way to get the timezone
			between different releases.  Back out the
			change in 8.9.2 and don't attempt to derive
			a timezone.  Problem reported by Igor S. Livshits
			of the University of Illinois at Urbana-Champaign
			and Michael Dickens of Tetranet Communications.
		Reliant UNIX, the new name for SINIX, from Gert-Jan Looy
			of Siemens/SNI.
		SunOS 5.8 from John Beck of Sun Microsystems.
	CONFIG: SCO UnixWare 2.1 and 7.0 need TZ to get the proper
		timezone.  Problem noted by Petr Lampa of Technical
		University of Brno.
	CONFIG: Handle <@bestmx-host:user@otherhost> addressing properly
		when using FEATURE(bestmx_is_local).  Patch from Neil W.
		Rickert of Northern Illinois University.
	CONFIG: Properly handle source routed and %-hack addresses on
		hosts which the mailertable remaps to local:.  Patch from
		Neil W. Rickert of Northern Illinois University.
	CONFIG: Internal fixup of mailertable local: map value.  Patch from
		Larry Parmelee of Cornell University.
	CONFIG: Only add back +detail from host portion of mailer triplet
		on local mailer triplets if it was originally +detail.
		Patch from Neil W. Rickert of Northern Illinois University.
	CONFIG: The bestmx_is_local checking done in check_rcpt would
		cause later checks to fail.  Patch from Paul J Murphy of
		MIDS Europe.
	New files:
		BuildTools/OS/CRAYTS.10.0.x
		BuildTools/OS/ReliantUNIX
		BuildTools/OS/SunOS.5.8

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 5.0i for non-commercial use
Comment: Processed by Mailcrypt 3.5.1, an Emacs/PGP interface
Charset: noconv

iQCVAwUBNrpRFHxLZ22gDhVjAQHY4QP/U7usQ5qVk8SeB01hFVUzgknQCxuleSnF
rifPNdPGLYZK/r2rjncH916UgixIzt3c1a4G5C/JRh6aJPH1TczkgzOvgO+sCzrm
p0r/OBfey1r5aOIzz9bNiB+za4xLSa8oU1q0DcvOwoLD/1L/sGmxpKkYdByEyMSe
o33GYle/KFQ=
=AR73
-----END PGP SIGNATURE-----