[Exim] Re: Stopping deferred fail messages

トップ ページ
このメッセージを削除
このメッセージに返信
著者: Suresh Ramasubramanian
日付:  
To: exim-users
題目: [Exim] Re: Stopping deferred fail messages
+++ Alan J. Flavell [exim-users] <19/01/02 17:12 +0000>:
> Btw - has there been some new piece of spamware recently deployed?
> We're getting a tremendous outbreak of spam with envelope senders like
> nobody@www.somewhere.dom, or apache@ or www@ ditto, as if spammers
> have been harvesting open web-to-mail relays and are now misusing them
> with a vengeance. Is there an RBL site somewhere that's blacklisting
> this kind of loophole?


This is the good old formmail.pl or some such script. Exploit was posted on
bugtraq a while back (after spammers started using it). Now, looks like
someone's written (trivial) bots to scan an IP block for open formmail and
then exploit it.

Someone needs to write a few teergrubes for this ... create a bogus
formmail.pl that takes and holds HTTP/GET requests for long periods of time.

    -srs