1. Security bug in ZMailer smtpserver

There is a security fault in all ZMailer smtpservers that allow running router in interactive mode to assist/do address analysis with user inputs. This fault exists in all versions of ZMailer 2.20.0 + series previous to version 2.99.50s17.

1.1. How to detect if your system isn't vulnerable

If following happens when talking to your SMTP server, then your system is not vulnerable:

->> MAIL FROM:<"Sinead O'Connor"@domain.nam>
<<- 501 Syntax error in parameters or arguments

However your server is very old generation which violates some rules rejecting otherwise valid addresses.

2. Band-aid

Do not allow running router for EXPN, VRFY, MAIL FROM, RCPT TO !

You can disable those by removing characters 'e v f t' from the style flags at the $MAILSHARE/smtpserver.conf

(Or to -s option of the smtpserver either. Default for that option is 've', so you must supply option: '-s .' which zeroes the enable flag set.)

2.1. The end of the `smtpserver.conf` before the band-aid

#
#
# HELO/EHLO-pattern	style-flags (Remember: 'ftve' set needs enable-router!)
#               [max loadavg]
#
localhost	    999	ftveR
some.host.domain    999	!NO EMAIL ACCEPTED FROM YOUR MACHINE
# If the host presents itself as:  HELO [1.2.3.4], be lenient to it..
# The syntax below is due to these patterns being SH-GLOB style patterns
# where the brackets are special characters.
\[*\]		    999	ve
# Per default demant strict syntactic adherence, including fully
# qualified addresses for  MAIL FROM, and RCPT TO.  To be lenient
# on that detail, remove the "R" from "veR" string below:
*		    999	veR

2.2. The end of the `smtpserver.conf` after the band-aid

#
#
# HELO/EHLO-pattern	style-flags (Remember: 'ftve' set needs enable-router!)
#               [max loadavg]
#
localhost	    999	R
some.host.domain    999	!NO EMAIL ACCEPTED FROM YOUR MACHINE
# If the host presents itself as:  HELO [1.2.3.4], be lenient to it..
# The syntax below is due to these patterns being SH-GLOB style patterns
# where the brackets are special characters.
\[*\]		    999	.
# Per default demant strict syntactic adherence, including fully
# qualified addresses for  MAIL FROM, and RCPT TO.  To be lenient
# on that detail, remove the "R" from "veR" string below:
*		    999	R

3. Fix, and danger of nullifying it

This fault is corrected at the 2.99.50s17 release, but if you e.g. tinker with your router configuration scripts, you may open up new holes.

That is why running of the interactive router is made difficult, you have to be aware that you are doing it!

With new systems you must do more tuning of the smtpserver.conf file in your system. Various protocol items and features using router facilities are not enabled per default!