Re: [Exim] potential security problem with lookups

Pàgina inicial
Delete this message
Reply to this message
Autor: Alexey Y. Promokhov
Data:  
A: Nico Erfurth
CC: exim-users
Assumpte: Re: [Exim] potential security problem with lookups
On Wed, 7 May 2003, Nico Erfurth wrote:

> > accept senders = ${if exists {/usr/local/etc/exim/whitesender+$domain} {/usr/local/etc/exim/whitesender+$domain} {:}}
> >
> > It means a whitelist for users in one of virtual domains. But if sender
> > of processed message is <>, i.e. it's a bounce message, then lookup is
> > hit, even if recipient is in foreign domain. So, the above construction
> > gives an open relay.


> Yes, because you made it one
> : is the list seperator, if you have nothing in front of it, it will
> check for a empty string and this matches your bounce.
>
> AFAIK this is documented in spec.txt


Thank you. I just looked it documentation more carefully, and found it.
Sorry for causing inconvenience.

--
Alexey Y. Promokhov, system administrator
Joint Stock Venture "GP Telecom", Moscow, Russia