The second-to last Received header of the original message mentions
fetchmail - my guess would be that that fetchmail setup is improperly
configured and after POPing the message it is injecting it into its
local MTA using a "From" header instead of the envelope sender (possibly
the server it is POPing is not configured to preserve the envelope
sender in some header for such use.
I hate fetchmail. This is one of the reasons
On Fri, 18 May 2001, Greg A. Woods wrote:
> Why did I get this bounce directly? Why did it not go to the SMTP
> envelope sender address? Is it a bug in Exim?
>
> Although Exim doesn't show the sender address in the Received header it
> generates (at least the one at asterix.hrz.tu-chemnitz.de doesn't seem
> to do so), I expect the SMTP envelope sender address was in fact the
> same as it was for the copy of the message as I received it directly
> from the list:
>
> <bugtraq-return-113-woods-bugtraq=planix.com@???>
>
> (Note that BUGTRAQ recently switched from LISTERV to EZMLM, which though
> very good for some reasons seems to have triggered lots of mis-behaviour
> like this in various mailers.)
>
> ------- start of forwarded message (RFC 934 encapsulation) -------
> Return-Path: <MAILER-DAEMON>
> Received: from asterix.hrz.tu-chemnitz.de([134.109.132.84]) (9228 bytes) by most.weird.com
> via sendmail with P:esmtp/D:user/T:local
> (sender: <MAILER-DAEMON> owner: <real-woods>)
> id <m150v6H-000g5sC@???>
> for <woods@???>; Fri, 18 May 2001 21:00:09 -0400 (EDT)
> (Smail-3.2.0.112-Pre 2000-Feb-17 #12 built 2001-Feb-5)
> Received: from sunnyboy.informatik.tu-chemnitz.de ([134.109.193.18])
> by asterix.hrz.tu-chemnitz.de with esmtp (Exim 3.22 #4)
> id 150v6F-0003HW-00
> for woods@???; Sat, 19 May 2001 03:00:07 +0200
> Received: from scooby.csn.tu-chemnitz.de (scooby.csn.tu-chemnitz.de [134.109.108.1])
> by sunnyboy.informatik.tu-chemnitz.de (8.8.8+Sun/8.8.8) with ESMTP id DAA23383
> for <woods@???>; Sat, 19 May 2001 03:00:07 +0200 (MET DST)
> Received: from mail by scooby.csn.tu-chemnitz.de with local (Exim 3.22 #1 (Debian))
> id 150v6E-0004RL-00
> for <woods@???>; Sat, 19 May 2001 03:00:06 +0200
> Message-Id: <E150v6E-0004RL-00@???>
> Date: Sat, 19 May 2001 03:00:06 +0200
> From: Mail Delivery System <Mailer-Daemon@???>
> To: woods@???
> Subject: Mail delivery failed: returning message to sender
> X-Failed-Recipients: queue@localhost
>
> This message was created automatically by mail delivery software (Exim).
>
> A message that you sent could not be delivered to one or more of its
> recipients. This is a permanent error. The following address(es) failed:
>
> pipe to | /usr/bin/procmail
> generated by queue@localhost
>
> The following text was generated during the delivery attempt:
>
> - ------ pipe to | /usr/bin/procmail
> generated by queue@localhost ------
>
> procmail: Error while writing to ""
>
> - ------ This is a copy of the message, including all the headers. ------
>
> Return-path: <woods@???>
> Received: from localhost.localdomain ([127.0.0.1] helo=localhost)
> by scooby.csn.tu-chemnitz.de with esmtp (Exim 3.22 #1 (Debian))
> id 150v6E-0004RC-00
> for <queue@localhost>; Sat, 19 May 2001 03:00:06 +0200
> Received: from 127.0.0.1 [127.0.0.1]
> by localhost with POP3 (fetchmail-5.7.4)
> for queue@localhost (single-drop); Sat, 19 May 2001 03:00:06 +0200 (CEST)
> Received: from asterix.hrz.tu-chemnitz.de (asterix.hrz.tu-chemnitz.de [134.109.132.84])
> by sunnyboy.informatik.tu-chemnitz.de (8.8.8+Sun/8.8.8) with ESMTP id CAA22770
> for <alg@???>; Sat, 19 May 2001 02:45:03 +0200 (MET DST)
> Received: from mout01.kundenserver.de ([195.20.224.132])
> by asterix.hrz.tu-chemnitz.de with esmtp (Exim 3.22 #4)
> id 150ure-0003AP-00
> for alg@???; Sat, 19 May 2001 02:45:02 +0200
> Received: from [212.227.126.152] (helo=mxng01.kundenserver.de)
> by mout01.kundenserver.de with esmtp (Exim 2.12 #2)
> id 150umn-0006I1-00
> for alg@???; Sat, 19 May 2001 02:40:01 +0200
> Received: from [66.38.151.6] (helo=outgoing.securityfocus.com)
> by mxng01.kundenserver.de with esmtp (Exim 3.22 #2)
> id 150umd-0000Fw-00
> for alex@???; Sat, 19 May 2001 02:39:51 +0200
> Received: from lists.securityfocus.com (lists.securityfocus.com [66.38.151.19])
> by outgoing.securityfocus.com (Postfix) with SMTP id 2F0A325D34E
> for <alex@???>; Fri, 18 May 2001 18:37:24 -0600 (MDT)
> Received: (qmail 29806 invoked by alias); 18 May 2001 23:59:40 -0000
> Mailing-List: contact bugtraq-help@???; run by ezmlm
> Precedence: bulk
> List-Id: <bugtraq.list-id.securityfocus.com>
> List-Post: <mailto:bugtraq@securityfocus.com>
> List-Help: <mailto:bugtraq-help@securityfocus.com>
> List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
> List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
> Delivered-To: mailing list bugtraq@???
> Delivered-To: moderator for bugtraq@???
> Received: (qmail 16515 invoked from network); 18 May 2001 20:44:02 -0000
> MIME-Version: 1.0
> Content-Type: text/plain; charset=us-ascii
> Content-Transfer-Encoding: 7bit
> From: woods@??? (Greg A. Woods)
> To: wietse@??? (Wietse Venema)
> Cc: bugtraq@???
> Subject: Re: Mail delivery privileges (was: Solaris /usr/bin/mailx exploit)
> In-Reply-To: <20010518151851.93FBABC074@???>
> References: <20010517155738.5824DC2@???>
> <20010518151851.93FBABC074@???>
> X-Mailer: VM 6.92 under Emacs 21.0.100.1
> Reply-To: woods@??? (Greg A. Woods)
> Organization: Planix, Inc.; Toronto, Ontario; Canada
> Message-Id: <20010518203508.DCF0EC3@???>
> Date: Fri, 18 May 2001 16:35:08 -0400 (EDT)
>
> [[ .... content deleted by GAW .... ]]
>
> ------- end -------
>
>
--
