Re: SECURITY HOLE: FormMail

[Andrew.Macpherson () bnr co uk (Andrew Macpherson)]

Christian Wettergren wrote:

| I don't know about smail and pp though. The key here is however that
| it is _legitimate_ requests for _features_ that is the problem, not
| any bugs. (I usually phrase this as thought-of "pure" data that is
| actually containing meta-data syntax escapes.)

I'm not 100% sure about smail.  PP will only deliver to programs
which the administrator has configured in 2 different tables ---

The program *must* be accessed via a label (join key) in both the users'
table, and the shell table, or from the user's mailfilter file.  The
user-of-execution is specified in the shell table, or is the owner of the
mailfilter, and altogether one feels fairly happy about pp and program
delivery, because the programs are all under local control.  It is impossible
for the submitter to specify a program.

As for sendmail: well we have had bug-of-the-week from that for so long now...
the least one expects is the administrator has installed the checking program
on the program channel.  Personally I will not touch it anywhere where
delivery can be effected.
--
 Andrew.Macpherson.1248566 () bnr co uk    - or -    andrew () bnr ca
"Northern Telecom has committed to a 30% reduction in its use of paper
 by the year 2000."   No faxes, or printouts please, just e-mail.