Dear All:
Many thanks to Tom Pratum, Clemens Anklin, Eugenio Alvarado, Dave Scott,
Woody Conover, Bill Gurley, and anyone that I accidentally left out. I
received several requests to post exactly what happened, so here it is.
The "hole", and corresponding exploit for older version of FormMail.pl
(before version 1.9) is well known (to everyone, it seems, but me
<grin>).
A detailed description for how the exploit works can be found at:
http://www.ctssn.com/linux/formMailExploit.html
or
http://www.linux.opennet.ru/base/exploits/993631642_276.txt.html
The latest version of FormMail.pl (from Matt's script archive) is at:
http://www.worldwidemart.com/scripts/formmail.shtml . The new version
has a basic plug for the hole, but I'm also going to add the patch
listed at
http://www.ctssn.com/linux/formMailFix.html .
Bottom line is that any utility that accepts plain-text input
(especially via HTTP services), and funnels it through low-level system
daemons (i.e. sendmail) is going to be a worry. It's nice that we NMR
facility managers have so much time on our hands that we can always
remain current with the latest exploits and vulnerabilities (yeah,
right!) 8-).
Cheers,
-Rich Shoemaker
---
Richard K. Shoemaker, Ph.D.
NMR Facility Director
University of Colorado at Boulder
Phone: (303) 492-7062 Fax: (303) 492-5894
E-Mail: Richard.Shoemaker_at_Colorado.edu
Received on Tue Feb 12 2002 - 12:45:19 MST