[Exim] spam mail causes exim to crash

Top Page
Delete this message
Reply to this message
Author: Stefan Toobe
Date:  
To: exim-users
Subject: [Exim] spam mail causes exim to crash
hi,

I received some mails (always the same sender, spammer) which causes
exim 3.3.6 (with last patch) to crash. Always the same procedure

1. receiving the mail
2. no local_delivery
3. mail will be queued
4. every queue run the mail causes this:

<exim_paniclog>
2003-10-07 11:21:38 queue run: process 30354 crashed with signal 9
while delivering 1A6nJX-0007gW-00
2003-10-07 12:19:04 queue run: process 507 crashed with signal 9
while delivering 1A6nJX-0007gW-00
2003-10-07 13:23:20 queue run: process 4611 crashed with signal 9
while delivering 1A6nJX-0007gW-00
2003-10-07 13:29:01 queue run: process 4860 crashed with signal 9
while delivering 1A6nJX-0007gW-00
2003-10-07 14:28:45 queue run: process 7810 crashed with signal 9
while delivering 1A6nJX-0007gW-00
2003-10-07 15:45:54 queue run: process 458 crashed with signal 9
while delivering 1A6nJX-0007gW-00
2003-10-07 16:46:52 queue run: process 4310 crashed with signal 9
while delivering 1A6nJX-0007gW-00
</exim_paniclog>

and

<messages>
Oct 7 10:57:42 webmserver kernel: __alloc_pages: 0-order allocation
failed (gfp=0x1d2/0)
Oct 7 10:57:42 webmserver kernel: VM: killing process pop3login
</messages>

and so on, and on - all processes will be killed, at least the server
hangs. I´ve saved three mails out of the queue, all look the same: a
regular body file and a very big sized header-file up to 28kb, filled
with many different "x-transfer-number" lines.

You can check out the files on
http://www.wolfgang-doeringer.de/exim/

workaround: regex check the header files before queue-run via cron and
move them far far away ...


--
Stefan Toobe,
toobe at web dot de