You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2006/07/13 13:10:16 UTC
[Bug 4989] New: Failure to parse sendmail received headers allows abuse of whitelist_rcvd
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4989
Summary: Failure to parse sendmail received headers allows abuse
of whitelist_rcvd
Product: Spamassassin
Version: 3.0.4
Platform: All
OS/Version: other
Status: NEW
Severity: normal
Priority: P3
Component: spamassassin
AssignedTo: dev@spamassassin.apache.org
ReportedBy: p.boven@chello.nl
SpamAssassin misinterperts the Received-headers from Sendmail (occurs at least
with 8.13.6+Sun). This makes it possible for spammers to abuse whitelist_rcvd
entries, e.g. from 70_sare_whitelist.cf. I have several examples on seperate
mailservers that managed to slip trough before I disabled the rule in question,
and they're still trying.
To quote Justin Mason's analysis of my debug output:
Received: from vm.vonage.com ([220.166.39.177]) by amsfep14-int.chello.nl
(InterMail vM.6.01.04.04 201-2131-118-104-20050224) with SMTP
id <20...@vm.vonage.com>
for <p....@chello.nl>; Thu, 13 Jul 2006 08:33:46 +0200
This actually means "received from IP 220.166.39.177, which had no
rDNS, which HELO'd as vm.vonage.com". SpamAssassin parses it as:
debug: received-header: parsed as [ ip=220.166.39.177 rdns=vm.vonage.com
helo=vm.vonage.com by=amsfep14-int.chello.nl ident= envfrom= intl=0
id=20060713063346.DQLW12552.amsfep14-int.chello.nl@vm.vonage.com auth= ]
in other words "received from IP 220.166.39.177, which had both rDNS and
HELO of vm.vonage.com". Note that it's used the HELO string as rDNS,
incorrectly. This is the bug.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4989] Failure to parse sendmail received headers allows abuse of whitelist_rcvd
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4989
------- Additional Comments From p.boven@chello.nl 2006-07-13 14:25 -------
The Received: header in question gets matches in the qmail block of
Message/Metadata/Received.pm at around line 648 (SA-3.1.1). With at least
sendmail and apperently also Intermail, the header in question means there was
no RDNS available. But in Received.pm, what happens is this:
elsif (/^from (\S+) \(\[?(${IP_ADDRESS})\]?\)( \(envelope-sender
<\S+>\))? by (\S+)/) {
$helo = $rdns = $1; $ip = $2; $by = $4;
}
With $rdns filled in, and $mta_looked_up_dns = 1 at the end of this block, SA is
led to believe that the reverse DNS matched while in fact there was no rDNS
entry for the IP in question at all.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4989] Failure to parse sendmail received headers allows abuse of whitelist_rcvd
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4989
felicity@apache.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |DUPLICATE
------- Additional Comments From felicity@apache.org 2006-07-13 15:36 -------
This was fixed already for 3.1.2 in bug 4813.
The header provided is properly parsed as:
[14888] dbg: received-header: parsed as [ ip=220.166.39.177 rdns=
helo=vm.vonage.com by=amsfep14-int.chello.nl ident= envfrom= intl=0
id=20060713063346.DQLW12552.amsfep14-int.chello.nl@vm.vonage.com auth= ]
*** This bug has been marked as a duplicate of 4813 ***
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.