[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <553FC853.3080009@msapiro.net>
Date: Tue, 28 Apr 2015 10:50:11 -0700
From: Mark Sapiro <mark@...piro.net>
To: Kurt Seifried <kseifried@...hat.com>, mailman-security@...hon.org,
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Limited DoS in mailman (requires non standard config)
On 04/28/2015 10:04 AM, Kurt Seifried wrote:
> So I recently ran into a flaw in mailman where I had imported a text
> list of email addresses of people that wanted to sign up. It turns out
> one of the addresses was in the form "user@...ain.tld/random", not sure
> how that snuck in but anyways. When sending email to this list it fails
> due to that address being present:
What Mailman version is this?
I don't think any recent version would add that address to a list
regardless of how it was attempted to be added.
> from mailman posts log:
>
> Apr 28 16:46:23 2015 (29704) post to testing from testing-request@XXX,
> size=1786, message-id=<mailman.0.1430239582.16535.testing@XXX>, 1 failures
>
> from smtp-failure log:
>
> smtp-failure:Apr 28 16:46:44 2015 (29704) All recipients refused:
> {'kurt@...fried.org/foo': (501, '5.1.3 Bad recipient address syntax')},
> msgid: <CAEo5KB7F3LNCv7Q09ppqBRgUZTaGizyRHx1WS81w8K7S8Yhk7A@YYY>
And I think the only address refused was the one kurt@...fried.org/foo
address. The 'All recipients refused:' refers to all recipients in that
SMTP transaction, not necessarily every list member.
What does your MTA log say about this delivery? And what does Mailman's
'smtp' log say?
--
Mark Sapiro <mark@...piro.net> The highway is for gamblers,
San Francisco Bay Area, California better use your sense - B. Dylan
Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
