potential smail security bug

[George Bonser <grep@shorelink.com>]

I found this interesting tidbit on comp.mail.smail. The individual is
using smail-3.2.0.100 so I am not sure if this is fixed in newer versions.

Scenario:

Remote site connects to your mail server. In the reverse DNS lookup, the
remote admin has pointed the in-addr.arpa PTR record to your mailhosts
name. The forward and reverse lookups do not match, smail warns of the
discrepancy in the log file but accepts the mail anyway. In this case, the
host gives a trusted HELO and has a trusted reverse DNS though the forward
DNS (look up the hostname, find the IP address) does not match.

A spammer has pumped tons of mail through that site for relay to third
parties though the normal anti-relay measures are in place.



George Bonser

The Linux "We're never going out of business" sale at an FTP site near you!