full-disclosure - Please fix your e-mail system

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri May 20 19:38:22 2005
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Please fix your e-mail system


Mail goes from the list to a subscriber at the af.mil address - and the
Exchange server does the obviously broken thing and tries to send it back to
the RFC822 cc: field, instead of doing what it's supposed to do and deliver it
to the RFC821 'RCPT TO:' (which it knows - see the first Received: header has
the 'for <destination>' in it, and sending bounces back to the RFC821 MAIL
FROM:

Obligatory Full-Disclosure tie-in:  Here we have an obviously misconfigured
mail system inside the 'af.mil' domain.  Three of the servers were even nice
enough to identify their exact patch levels (It appears that 2 of them are
still at .211 rather than .1830).  How many different ways can you think of to
leverage the information in the Received: headers into a full-scale intrusion?

I already know why *I* know all this - anybody care to guess how? (The list
managers are ineligible for this one.. ;)

Received: from fsjubj14.exchange.gunter.af.mil (FSJUBJ14.exchange.gunter.af.mil [143.158.200.214])
	by lists.grok.org.uk (Postfix) with ESMTP id BE8847D4
	for <full-disclosure@...ts.grok.org.uk>; Fri, 20 May 2005 18:55:39 +0100 (BST)
Received: from fsjubj12.exchange.gunter.af.mil ([143.158.200.212]) by fsjubj14.exchange.gunter.af.mil with Microsoft SMTPSVC(6.0.3790.211);
	 Fri, 20 May 2005 12:55:38 -0500
Received: from mail pickup service by fsjubj12.exchange.gunter.af.mil with Microsoft SMTPSVC;
	 Fri, 20 May 2005 12:55:29 -0500
Received: from fsjubj13.exchange.gunter.af.mil ([143.158.200.213]) by fsjubj12.exchange.gunter.af.mil with Microsoft SMTPSVC(6.0.3790.211);
	 Fri, 20 May 2005 11:12:49 -0500
Received: from smtpgw1.gunter.afmc.ds.af.mil ([143.158.253.9]) by fsjubj13.exchange.gunter.af.mil with Microsoft SMTPSVC(6.0.3790.1830);
	 Fri, 20 May 2005 11:12:48 -0500
Received: from lists.grok.org.uk ([195.184.125.51])
 by smtpgw1.gunter.afmc.ds.af.mil (SAVSMTP 3.1.1.32) with SMTP id M2005052011053121905
 for <suzanne.vanpatten@...ter.af.mil>; Fri, 20 May 2005 11:05:31 -0500

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050520/8c66c9bf/attachment-0001.bin