Re: [Exim] potential security problem with lookups

Alexey Promokhov wrote:

> There was the following ACL statement:
>
> accept senders = ${if exists {/usr/local/etc/exim/whitesender+$domain} {/usr/local/etc/exim/whitesender+$domain} {:}}
>
> It means a whitelist for users in one of virtual domains. But if sender
> of processed message is <>, i.e. it's a bounce message, then lookup is
> hit, even if recipient is in foreign domain. So, the above construction
> gives an open relay.

Yes, because you made it one
: is the list seperator, if you have nothing in front of it, it will
check for a empty string and this matches your bounce.

AFAIK this is documented in spec.txt

Nico