Re: [Exim] potential security problem with lookups

On Wed, 7 May 2003, Nico Erfurth wrote:

> > accept senders = ${if exists {/usr/local/etc/exim/whitesender+$domain} {/usr/local/etc/exim/whitesender+$domain} {:}}
> >
> > It means a whitelist for users in one of virtual domains. But if sender
> > of processed message is <>, i.e. it's a bounce message, then lookup is
> > hit, even if recipient is in foreign domain. So, the above construction
> > gives an open relay.

> Yes, because you made it one
> : is the list seperator, if you have nothing in front of it, it will
> check for a empty string and this matches your bounce.
>
> AFAIK this is documented in spec.txt

Thank you. I just looked it documentation more carefully, and found it.
Sorry for causing inconvenience.

--
Alexey Y. Promokhov, system administrator
Joint Stock Venture "GP Telecom", Moscow, Russia