Re: [exim] Local user enumeration through RCPT

Kezdőlap
Üzenet törlése
Válasz az üzenetre
Szerző: John Burnham
Dátum: 2007-12-17 14:42 -000
Címzett: exim-users
Tárgy: Re: [exim] Local user enumeration through RCPT
> One of the servers we look after was recently "penetration
> tested" and they
> could find very little wrong so they complained about silly
> things like it's
> possible to see which users locally exist on the server
> through the answer
> Exim provides to the RCPT command.
>

Actually, surely all it's doing is enumerating the email addresses that that server
accepts mail for.... This may have little or no connection to the OS user accounts.
J