8.14.4

This version fixed a problem where some certificate authorities do not properly check the requests they are signing and hence allow spoofing via an embedded NUL in the CN entry…. A workaround for a Linux resolver problem has been added to avoid core dumps. A bug where the value of headers, e.g., Precedence, Content-Type, et.al., was not extracted correctly thus preventing them from being recognized properly was fixed. An erroneous reduction of the length limitation on a return path was fixed.

Detailed history and release notes are available at Freshmeat.net: http://freshmeat.net/projects/sendmail#release_310640

Sendmail, Inc., and the Sendmail Consortium announce the availability of sendmail 8.14.4. This version fixes some problems:

• some certificate authorities do not properly check the requests they are signing and hence allow spoofing via an embedded NUL in the CN entry. Some checks have been added to deal with “bogus” CNs (see below and doc/op/op.*).
• a workaround for a Linux resolver problem has been added to avoid core dumps.
• the value of headers, e.g., Precedence, Content-Type, et.al., was not extracted correctly thus preventing them from being recognized properly; leading spaces were not stripped (which was an unintended side effect of an earlier change) and hence comparing them with expected values (e.g., “first-class” for Precedence) did not work.
• between 8.11.7 and 8.12.0 the length limitation on a return path was erroneously reduced.

For a full list of changes see the release notes down below.

Please send bug reports and general feedback to one of the usual addresses.

The version can be found at

• ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.14.4.tar.gz
• ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.14.4.tar.gz.sig
• ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.14.4.tar.Z
• ftp://ftp.sendmail.org/pub/sendmail/sendmail.8.14.4.tar.Z.sig

or on a mirror near to you.

MD5 signatures:

1b23d5000c8e7bfe82ec1a27f2f5fdc5 sendmail.8.14.4.tar.gz

0986e83fefad74477e5473860eb7a3dc sendmail.8.14.4.tar.gz.sig

db975437af4b08ed3b88deaccec26f89 sendmail.8.14.4.tar.Z

8a5740dff8a85e0d5a8d754bf73c0b28 sendmail.8.14.4.tar.Z.sig

Since sendmail 8.11 and later includes hooks to cryptography, the following information from OpenSSL applies to sendmail as well.

PLEASE REMEMBER THAT EXPORT/IMPORT AND/OR USE OF STRONG CRYPTOGRAPHY SOFTWARE, PROVIDING CRYPTOGRAPHY HOOKS OR EVEN JUST COMMUNICATING TECHNICAL DETAILS ABOUT CRYPTOGRAPHY SOFTWARE IS ILLEGAL IN SOME PARTS OF THE WORLD. SO, WHEN YOU IMPORT THIS PACKAGE TO YOUR COUNTRY, RE-DISTRIBUTE IT FROM THERE OR EVEN JUST EMAIL TECHNICAL SUGGESTIONS OR EVEN SOURCE PATCHES TO THE AUTHOR OR OTHER PEOPLE YOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO ANY EXPORT/IMPORT AND/OR USE LAWS WHICH APPLY TO YOU. THE AUTHORS ARE NOT LIABLE FOR ANY VIOLATIONS YOU MAKE HERE. SO BE CAREFUL, IT IS YOUR RESPONSIBILITY.

SENDMAIL RELEASE NOTES

$Id: RELEASE_NOTES,v 8.1963 2009/12/23 04:43:46 ca Exp $

This listing shows the version of the sendmail binary, the version of the sendmail configuration files, the date of release, and a summary of the changes in that release.

8.14.4/8.14.4 2009/12/30
SECURITY:

Handle bogus certificates containing NUL characters in CNs by placing a string indicating a bad certificate in the {cn_subject} or {cn_issuer} macro.

Patch inspired by Matthias Andree’s changes for fetchmail. During the generation of a queue identifier an integer overflow could occur which might result in bogus characters being used. Based on patch from John Vannoy of Pepperdine University. The value of headers, e.g., Precedence, Content-Type, et.al., was not processed correctly.

Patch from Per Hedeland. Between 8.11.7 and 8.12.0 the length limitation on a return path was erroneously reduced from MAXNAME (256) to MAXSHORTSTR (203).

Patch from John Gardiner Myers of Proofpoint; the problem was also noted by Steve Hubert of University of Washington.

Prevent a crash when a hostname lookup returns a seemingly valid result which contains a NULL pointer (this seems to be happening on some Linux versions).

The process title was missing the current load average when the MTA was delaying connections due to DelayLA.

Patch from Dick St.Peters of NetHeaven. Do not reset the number of queue entries in shared memory if only some of them are processed.

Fix overflow of an internal array when parsing some replies from a milter. Problem found by Scott Rotondo of Sun Microsystems.

If STARTTLS is turned off in the server (via M=S) then it would not be initialized for use in the client either.

Patch from Kazuteru Okahashi of IIJ. If a Diffie-Hellman cipher is selected for STARTTLS, the handshake could fail with some TLS implementations because the prime used by the server is not long enough.

Note: the initialization of the DSA/DH parameters for the server can take a significant amount of time on slow machines.

This can be turned off by setting DHParameters to none or a file (see doc/op/op.me). Patch from Petr Lampa of the Brno University of Technology.

Fix handling of `b’ modifier for DaemonPortOptions on little endian machines for loopback address. Patch from John Beck of Sun Microsystems.

Fix a potential memory leak in libsmdb/smdb1.c found by parfait. Based on patch from Jonathan Gray of OpenBSD. If a milter sets the reply code to “421″ during the transfer of the body, the SMTP server will terminate the SMTP session with that error to match the behavior of the other callbacks. Return EX_IOERR (instead of 0) if a mail submission fails due to missing disk space in the mail queue. Based on patch from Martin Poole of RedHat.

CONFIG: Using FEATURE(`ldap_routing’)'s `nodomain’ argument would cause addresses not found in LDAP to be misparsed.

CONFIG: Using a CN restriction did not work for TLS_Clt as it referred to a wrong macro. Patch from John Gardiner Myers of Proofpoint.

CONFIG: The option relaytofulladdress of FEATURE(`access_db’) did not work if FEATURE(`relay_hosts_only’) is used too. Problem noted by Kristian Shaw.

CONFIG: The internal function lower() was broken and hence strcasecmp() did not work either, which could cause problems for some FEATURE()s if upper case arguments were used. Patch from Vesa-Matti J Kari of the University of Helsinki.

LIBMILTER: Fix internal check whether a milter application is compiled against the same version of libmilter as it is linked against (especially useful for dynamic libraries).

LIBMILTER: Fix memory leak that occurred when smfi_setsymlist() was used. Based on patch by Dan Lukes.

LIBMILTER: Document the effect of SMFIP_HDR_LEADSPC for filters which add, insert, or replace headers. From Benjamin Pineau.

LIBMILTER: Fix error messages which refer to “select()” to be correct if SM_CONF_POLL is used. Based on patch from John Nemeth.

LIBSM: Fix handling of LDAP search failures where the error is carried in the search result itself, such as seen with OpenLDAP proxy servers.

VACATION: Do not refer to a local variable outside its scope. Based on patch from Mark Costlow of Southwest Cyberport.

Portability: Enable HAVE_NANOSLEEP for SunOS 5.11.

Patch from John Beck of Sun Microsystems. Drop NISPLUS from default SunOS 5.11 map definitions.

Patch from John Beck of Sun Microsystems.

From: http://www.sendmail.org/releases/8.14.4