Re: open relay

[Robert Kurjata <rkurjata@ire.pw.edu.pl>]

Cytowanie Matti Aarnio <mea@nic.funet.fi>:

> On Wed, Jun 25, 2003 at 02:16:33PM +0200, Robert Kurjata wrote:
> > Previously:
> ...
> > So am I, zmailer 2.99.51 (alas it needs to be that version, cause it
> > is a very old system and newer version denies to compile properly
> > (everything is too old)) and I got into RBL so the things are getting
> > urgent. This is the only test my system failed.
> 
> Well, "too old" is only relative.  We could (should, IMO) improve
> the compilation to be able to compile in your system, too.
> 

It is old. kernel 2.0.35 (1999 y.), gcc 2.7.2.1 :)

> ZMailer's basic ideas include capability to function in "ancient"
> systems, perhaps not with best possible performance, but at least
> somehow.

[Cut out a part]

> 
>   In   canon.cf   canonicalize()  function, there is  $(dequote ..)  call
>   line.  Comment that away.  Unfortunately it isn't enough, as you can
>   see above,   `` ssift "$address" in ''  will internally strip paired
>   outer quotes, which is BAD THING in this case!
> 
>   Hmm..   Ah, lets hack:  Rewrite the beginning of the canonicalize() as:
> 
> canonicalize (address) {
>     # address="$(dequote -- "$address"))"
>     ssift "$address" in
>        (.*)	# This will ALWAYS match any input
> 		if [ "$address" != "\1" ] ; then
> 			# Inside and outside  ssift  the value changed,
> 			# most likely due to double-quotes around it!
> 			# Return it as it is.
> 			echo -- "$address"
> 			return
> 		fi
> 		;;
>     tfiss
> 
>   .... rest of the canonicalize()  function
> 
> }
> 

So it works, but: Zmailer is treating this as a local address and
send bounce mail back which may be abused too. He still accepts mail
(250 OK).
Shouldn't he check it differently?? eg. returning
          Relaying Denied or User Unknown

I've just checked my 2.99.55-patch1 - he acts the same way -> accepts
mail and sends a bounce. But there is an issue:
I can use this mechanism for spamming. Its just a very easy mechanism
- just use you victim address as a field FROM: and he will get all the
bounces, and people do read bounces. 

And that is why I got on the blacklist. Because of forced bounces.

What do you think about it?


> > -- 
> > Greetings,
> >  Robert                            mailto:rkurjata@ire.pw.edu.pl
> -- 
> /Matti Aarnio	<mea@nic.funet.fi>
> -
> To unsubscribe from this list: send the line "unsubscribe zmailer" in
> the body of a message to majordomo@nic.funet.fi
> 


-- 
Robert Kurjata     mailto:rkurjata@ire.pw.edu.pl


-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/
-
To unsubscribe from this list: send the line "unsubscribe zmailer" in
the body of a message to majordomo@nic.funet.fi