I have found a way in which somebody could subscribe other people's
address .
This is due to an autoanswer script that send back to the alleged poster
a message with
....
From: ignare.user@???
Subject: Re: original subject
I am on vacation until 31 august. Your messages will be read after that
date . Signed
.....
Someone could then send a mail to somelist-subscribe@somedomain
using as a from address ignare.user@???.
The list manager would semd to confirm request to that address, and
the autoresponder would send back something that contain the "key"in
the subject and so the subscription process is completed.
It works fine with yahoogroups, btw ....
Is there a way to word autoanswer replies to avoid this "autosubscribe
feature" ??
(I discovered when a virus sent to a list-subscribe address a message
with a fake, but real, from address ... as the list owner i received a
message replying to welcome message form someone away from e-mail
since 2 days ....) ..
--
Leonardo Boselli
Nucleo Informatico e Telematico del Dipartimento Ingegneria Civile
Universita` di Firenze , V. S. Marta 3 - I-50139 Firenze
tel +39 0554796431 cell +39 3488605348 fax +39 055495333
http://www.dicea.unifi.it/~leo
