Please Install the Updated Packages.

Sendmail is a very widely used Mail Transport Agent (MTA). MTAs deliver mail from one machine to another. Sendmail is not a client program, but rather a behind-the-scenes daemon that moves email over networks or the Internet to its final destination. The configuration of sendmail in Red Hat Enterprise Linux was found to not reject the &quot localhost.localdomain&quot domain name for email messages that come from external hosts. This could allow remote attackers to disguise spoofed messages. (CVE-2006-7176) A flaw was found in the way sendmail handled NUL characters in the CommonName field of X.509 certificates. An attacker able to get a carefully-crafted certificate signed by a trusted Certificate Authority could trick sendmail into accepting it by mistake, allowing the attacker to perform a man-in-the-middle attack or bypass intended client certificate authentication. (CVE-2009-4565) Note: The CVE-2009-4565 issue only affected configurations using TLS with certificate verification and CommonName checking enabled, which is not a typical configuration. This update also fixes the following bugs: * sendmail was unable to parse files specified by the ServiceSwitchFile option which used a colon as a separator. (BZ#512871) * sendmail incorrectly returned a zero exit code when free space was low. (BZ#299951) * the sendmail manual page had a blank space between the -qG option and parameter. (BZ#250552) * the comments in the sendmail.mc file specified the wrong path to SSL certificates. (BZ#244012) * the sendmail packages did not provide the MTA capability. (BZ#494408) All users of sendmail are advised to upgrade to these updated packages, which resolve these issues.

sendmail on Red Hat Enterprise Linux (v. 5 server)

• https://www.redhat.com/archives/rhsa-announce/2010-March/msg00033.html

---

Updated on 2015-03-25