Re: Help Needed with Perl cgi script and spam problem

Knute Johnson <nospam@xxxxxxxxxxxxxxxxx> wrote:
axel@xxxxxxxxxxxxxxxxxxxxxx wrote:
>>> AFAIK the most typical problem is lack of sufficiently paranoid checks
of parameters entered into forms before passing them to sendmail e.g.
your script sends using "sendmail -t" (take recipeint addresses from
to:/cc: headers) and abusers use some other entries (e.g. *multiline*
subject) to insert "extra" to:/cc: headers.

I'm pretty sure that is how it was done but I really need to know
exactly how to do it so I can fix the code to prevent it.

How on earth do you expect people to tell you *exactly* how to fix
an unseen script and without having access to the details of the
spam generated?

Well Axel, if you had really read my post, I wasn't asking for somebody
to fix it but asking how they are attacked so I could fix it.

The same applies... how do you expect people to figure that out without
knowledge of the script and details of the spam? There are some very
old vulnerable scripts out there on the net which will accept all
kinds of parameters which can be used as possible hooks into generating
spam.

If you were to give the name of the script and a reference to the source,
then probably you would get far better responses other than general
advice on how to prevent spamming CGI mail scripts.

For example... useful details would be what was the spam? All to
the same form indicating a denial of service of attack; using Cc: and
Bcc: fields to send mail elsewhere; trying to spam multiple addresses
at your domain?

Axel
.

Relevant Pages

  • Re: Form Security
    ... After all this, if no error message has been generated, the form contents are emailed to me. ... I'm no Linux guru, so I don't know what someone could do to cause problems with this script, other than spam me. ... What he's proposing is false security - which is worse than no security ...
    (comp.lang.php)
  • Spam stopper. (Was Re: "ABC Consumer Reports" doesnt recommend Linux)
    ... I just had a look at your spam stopping script, which is a little bit like ... Please don't send me html mail or un-notified attachments. ...
    (comp.os.linux.misc)
  • Spam stopper. (Was Re: "ABC Consumer Reports" doesnt recommend Linux)
    ... I just had a look at your spam stopping script, which is a little bit like ... Please don't send me html mail or un-notified attachments. ...
    (comp.os.linux)
  • [Full-disclosure] Spam exploiting MS05-016
    ... It is not spam, ... the "agreement.txt " file contained a script to write a text ... via its "-s" option and further commands to run ftp with those scripted ...
    (Full-Disclosure)
  • Spam exploiting MS05-016
    ... It is not spam, ... the "agreement.txt " file contained a script to write a text ... via its "-s" option and further commands to run ftp with those scripted ...
    (Bugtraq)