You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2016/10/14 18:48:07 UTC
[Bug 7360] New: SPF check plugin should verify reply to (From:) as
well
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7360
Bug ID: 7360
Summary: SPF check plugin should verify reply to (From:) as
well
Product: Spamassassin
Version: unspecified
Hardware: PC
OS: Linux
Status: NEW
Severity: major
Priority: P2
Component: Plugins
Assignee: dev@spamassassin.apache.org
Reporter: petr@bena.rocks
Right now it's possible to easily bypass SPF checks by spoofing From: (reply
to) instead of envelope sender (sender).
Given that spam assasin checks only envelope sender, it doesn't notice that
someone is spoofing foreign domain and accepts the e-mail with no negative
score even if it originated from server that isn't listed in SPF records for a
domain.
How to reproduce:
send spoofed mail using this command:
mail -aFrom:hacker@apache.org -s "Your SPF can be easily hacked!"
someone@apache.org
SPF check will not be able to recognize that it's a spoof mail because envelope
sender will not be hacker@apache.org but the hostname of mail server. However
99% of all mail clients will display it as mail delivered by hacker@apache.org
and spam assasin should be able to know that.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7360] SPF check plugin should verify reply to (From:) as well
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7360
--- Comment #4 from AXB <ax...@gmail.com> ---
Please take further comments to the SA users list.
Bugzilla is not the right place do discuss this.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7360] SPF check plugin should verify reply to (From:) as well
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7360
AXB <ax...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |INVALID
--- Comment #1 from AXB <ax...@gmail.com> ---
SPF checks are applied the envelope sender address.
"From:" is not part of the SPF spec.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7360] SPF check plugin should verify reply to (From:) as well
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7360
--- Comment #5 from Benny Pedersen <me...@junc.eu> ---
maybe Sender-ID is much much better then SPF?
ironical microsoft does not use it anymore :-)
(use dkim would be solution)
or maybe time to make dmarc testing in SpamAssassin ?
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7360] SPF check plugin should verify reply to (From:) as well
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7360
--- Comment #6 from AXB <ax...@gmail.com> ---
(In reply to Benny Pedersen from comment #5)
> maybe Sender-ID is much much better then SPF?
>
> ironical microsoft does not use it anymore :-)
>
> (use dkim would be solution)
>
> or maybe time to make dmarc testing in SpamAssassin ?
Please take further comments to the SA users list.
Bugzilla is not the right place do discuss this.
this also applies to you.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7360] SPF check plugin should verify reply to (From:) as well
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7360
--- Comment #3 from AXB <ax...@gmail.com> ---
(In reply to Petr Bena from comment #2)
> Do you realize that this renders SPF check absolutely useless? Every script
> kiddie can bypass it as it's implemented in SA right now.
SpamAssassin didn't invent the spec.
SpamAssassin follows the spec.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7360] SPF check plugin should verify reply to (From:) as well
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7360
Petr Bena <pe...@bena.rocks> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |petr@bena.rocks
--- Comment #2 from Petr Bena <pe...@bena.rocks> ---
Do you realize that this renders SPF check absolutely useless? Every script
kiddie can bypass it as it's implemented in SA right now.
--
You are receiving this mail because:
You are the assignee for the bug.