Re: [Exim] request for help: CAN-1999-0531 expn exploitation

Greg,

Thanks for your detailed response! It would be interesting to learn
all the details of internet security, but alas, I don't have the time
it takes to do so. I was merely trying to figure out a way to rid
myself of the ridiculous messages the corporate scanners send me such
that I can say "I did the best I could". After I posted the request, I
indeed found a way: replaced exim with sendmail. Now I get the
following response from the scanners:

There were no known vulnerabilities found on ...

Your advice was similar to what the internal ornl.gov security experts
said to do (ignore it) because they do not want to support anything
else beyond sendmail. I was hoping I could get some specific help from
this mailing list to continue to use exim.

On Monday 19 November 2001 02:31 pm, Greg A. Woods wrote:
> I.e. you should turn off EXPN, leave VRFY enabled, and completely
> ignore ISS on this matter. :-)
>
> That does appear to be how at least three of the ornl.gov mailers
> your message passed through on its way to the exim-users list are
> configured....

--
James D. Freels, P.E._i, Ph.D.
Oak Ridge National Laboratory
freelsjd@??? - work
jdfreels@??? - home