sendmail 8.11.7 available

-----BEGIN PGP SIGNED MESSAGE-----

Sendmail, Inc., and the Sendmail Consortium announce the availability
of sendmail 8.11.7.  It contains fixes for critical security problems
discovered by Mark Dowd of ISS X-Force and Michal Zalewski whom we
thank for bringing these problems to our attention.  8.11.7 is a
bugfix release for those who are not able to upgrade to 8.12.9.
8.11 is not actively maintained by the Sendmail Consortium, however,
due to the recent security problems we felt obliged to not just
offer patches but a complete release which contains more fixes than
those for the two security problems.  For a complete list of changes
see the release notes down below.

Please send bug reports to [email protected] as usual.

Note: We have changed the way we digitally sign the source code
distributions to simplify verification: in contrast to earlier
versions two .sig files are provided, one each for the gzip'ed
version and the compressed version. That is, instead of signing the
tar file, we sign the compressed/gzip'ed files, so you do not need
to uncompress the file before checking the signature.

This version can be found at

ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.11.7.tar.gz
ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.11.7.tar.gz.sig
ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.11.7.tar.Z
ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.11.7.tar.Z.sig

and the usual mirror sites.

MD5 signatures:

96437c0ffdc23b02a5d3757017c295ec sendmail.8.11.7.tar.gz
5e99fc6021fdf29b0057b5ec75ffb05a sendmail.8.11.7.tar.gz.sig
0ffd529b7590767b8b54dc7a012deeb3 sendmail.8.11.7.tar.Z
79553ff85ca10b8863f1b128db7b682b sendmail.8.11.7.tar.Z.sig

You either need the first two files or the third and fourth, i.e.,
the gzip'ed version or the compressed version and the corresponding
.sig file.  The PGP signature was created using the Sendmail Signing
Key/2003, available on the web site (http://www.sendmail.org/) or
on the public key servers.

Since sendmail 8.11 and later includes hooks to cryptography, the
following information from OpenSSL applies to sendmail as well.

   PLEASE REMEMBER THAT EXPORT/IMPORT AND/OR USE OF STRONG CRYPTOGRAPHY
   SOFTWARE, PROVIDING CRYPTOGRAPHY HOOKS OR EVEN JUST COMMUNICATING
   TECHNICAL DETAILS ABOUT CRYPTOGRAPHY SOFTWARE IS ILLEGAL IN SOME
   PARTS OF THE WORLD.  SO, WHEN YOU IMPORT THIS PACKAGE TO YOUR
   COUNTRY, RE-DISTRIBUTE IT FROM THERE OR EVEN JUST EMAIL TECHNICAL
   SUGGESTIONS OR EVEN SOURCE PATCHES TO THE AUTHOR OR OTHER PEOPLE
   YOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO ANY EXPORT/IMPORT
   AND/OR USE LAWS WHICH APPLY TO YOU. THE AUTHORS ARE NOT LIABLE FOR
   ANY VIOLATIONS YOU MAKE HERE. SO BE CAREFUL, IT IS YOUR RESPONSIBILITY.

			SENDMAIL RELEASE NOTES
      $Id: RELEASE_NOTES,v 8.561.2.5.2.275 2003/03/30 02:33:35 ca Exp $

This listing shows the version of the sendmail binary, the version
of the sendmail configuration files, the date of release, and a
summary of the changes in that release.

8.11.7/8.11.7	2003/03/29
	SECURITY: Fix a remote buffer overflow in header parsing by
		dropping sender and recipient header comments if the
		comments are too long.  Problem noted by Mark Dowd
		of ISS X-Force.
	SECURITY: Fix a buffer overflow in address parsing due to
		a char to int conversion problem which is potentially
		remotely exploitable.  Problem found by Michal Zalewski.
  		Note: an MTA that is not patched might be vulnerable to
		data that it receives from untrusted sources, which
		includes DNS.
	To provide partial protection to internal, unpatched sendmail MTAs,
		8.11.7 changes by default (char)0xff to (char)0x7f in
		headers etc.  To turn off this conversion compile with
		-DALLOW_255 or use the command line option -d82.101.
	To provide partial protection for internal, unpatched MTAs that may be
		performing 7->8 or 8->7 bit MIME conversions, the default
		for MaxMimeHeaderLength has been changed to 2048/1024.
		Note: this does have a performance impact, and it only
		protects against frontal attacks from the outside.
		To disable the checks and return to pre-8.11.7 defaults,
		set MaxMimeHeaderLength to 0/0.
	Properly clean up macros to avoid persistence of session data
		across various connections.  This could cause session
		oriented restrictions, e.g., STARTTLS requirements,
		to erroneously allow a connection.  Problem noted
		by Tim Maletic of Priority Health.
	Ignore comments in NIS host records when trying to find the
		canonical name for a host.
	Fix a memory leak when closing Hesiod maps.
	Set ${msg_size} macro when reading a message from the command line
		or the queue.
	Prevent a segmentation fault when clearing the event list by
		turning off alarms before checking if event list is
		empty.  Problem noted by Allan E Johannesen of Worcester
		Polytechnic Institute.
	Fix a potential core dump problem if the environment variable
		NAME is set.  Problem noted by Beth A. Chaney of
		Purdue University.
	Prevent a race condition on child cleanup for delivery to files.
		Problem noted by Fletcher Mattox of the University of
		Texas.
	CONFIG: Do not bounce mail if FEATURE(`ldap_routing')'s bounce
		parameter is set and the LDAP lookup returns a temporary
		error.
	CONFIG: Fix a syntax error in the try_tls ruleset if
		FEATURE(`access_db') is not enabled.
	LIBSMDB: Fix a lock race condition that affects makemap, praliases,
		and vacation.
	LIBSMDB: Avoid a file creation race condition for Berkeley DB 1.X
		and NDBM on systems with the O_EXLOCK open(2) flag.
	MAKEMAP: Avoid going beyond the end of an input line if it does
		not contain a value for a key.  Based on patch from
		Mark Bixby from Hewlett-Packard.
	MAIL.LOCAL: Fix a truncation race condition if the close() on
		the mailbox fails.  Problem noted by Tomoko Fukuzawa of
		Sun Microsystems.
	SMRSH: SECURITY: Only allow regular files or symbolic links to be
		used for a command.  Problem noted by David Endler of
		iDEFENSE, Inc.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (OpenBSD)

iQCVAwUBPocsBc8etQMiMnoBAQHZIAP+NxsoBWE1TDdFz8qIabw6qNihzUrgd3fU
2l8+H/gBLzC5j0sgQOHYefsmKai81xSXbO80jZO5qoMO/vRAvj+MbOhPoinGpWhr
UbZx3DkwQZKgt3O2+GIICJ7jxmk7fosWQxfFAJ16RgF/Bj198TFesSUmJ/4tzWg+
iaI9GSqoCLE=
=yq+O
-----END PGP SIGNATURE-----