Low: sendmail security and bug fix update

Updated sendmail packages that fix a security issue and various bugs are now
available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Sendmail is a very widely used Mail Transport Agent (MTA). MTAs deliver
mail from one machine to another. Sendmail is not a client program, but
rather a behind-the-scenes daemon that moves email over networks or the
Internet to its final destination.

The configuration of Sendmail on Red Hat Enterprise Linux was found to not
reject the "localhost.localdomain" domain name for e-mail messages that
came from external hosts. This could have allowed remote attackers to
disguise spoofed messages (CVE-2006-7176).

This updated package also fixes the following bugs:

* Infinite loop within tls read.

* Incorrect path to selinuxenabled in initscript.

* Build artifacts from sendmail-cf package.

* Missing socketmap support.

* Add support for CipherList configuration directive.

* Path for aliases file.

* Failure of shutting down sm-client.

* Allows to specify persistent queue runners.

* Missing dnl for SMART_HOST define.

* Fixes connections stay in CLOSE_WAIT.

All users of Sendmail should upgrade to these updated packages, which
contains backported patches to resolve these issues.

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

121850 - [PATCH] infinite loop within tls_read
152282 - Incorrect path to selinuxenabled in /etc/init.d/sendmail
152955 - sendmail-cf contains rpm build artifacts
156191 - Changelog says 'Socketmap Supported' but it's not compiled in.
166744 - aliases man page specifies incorrect location of aliases file
171838 - CVE-2006-7176 sendmail allows external mail with from address xxx@localhost.localdomain
172352 - Sendmail allows SSLv2 during STARTTLS, and the CipherList config option isn't supported so you can't turn it off
200920 - shutting down sm-client fails
200921 - [PATCH] method to specify persistent queue runners?
200923 - sendmail.mc missing dnl on SMART_HOST define

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7176
http://www.redhat.com/security/updates/classification/#low

CipherList, localhost.localdomain