bugSpamAssassin Milter Plugin - Bugs: bug #14731, -x without -e has a security risk


bug #14731: -x without -e has a security risk

Submitter:  None
Submitted:  Thu 06 Oct 2005 05:58:56 AM UTC
Category:  None Severity:  4 - Important
Item Group:  None Status:  None
Privacy:  Public Assigned to:  dnelson
Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup

Sat 01 Aug 2020 07:11:54 PM UTC, comment #1: 

Needs recheck, but seems plausible.

Greg Troxel <gdt>
Group Member
Thu 06 Oct 2005 05:58:56 AM UTC, original submission:  

When configured with "-u nobody -x" and not using -e, outgoing or mail sent though the server could be intercepted by another user.

spamass-milter[17342]: calling /usr/lib/sendmail -bv "<Test@test.com>" 2>&1
spamass-milter[17342]: sendmail output: <test@test.com>... deliverable: mailer esmtp, host test.net., user -email is unavailable-
spamass-milter[17342]: user: -email is unavailable-
spamass-milter[17342]: Total of 1 actual recipients
spamass-milter[17342]: remembering -email is unavailable- for spamc
spamass-milter[17342]: remembering recipient <test@test.com>

spamass-milter[21108]: spamc gets test2
spamd[15262]: connection from localhost.localdomain [] at port 35697
spamd[15262]: info: setuid to test2 succeeded
spamd[15262]: processing message <di277llv+5d1n@eGroups.com> for test:533.

spamc now uses "test2" user_prefs file that neither the sender nor the rcpt have access to. Third party user "test2" then could configure there user_prefs to resend that mail to him/herself or do a number of tricks one could do in the user_prefs

Using "-i" with the local server IP can prevent mail sent though the server from being process by spamc, but forwarded mail is still at risk.

Sujested soluction, look at the "mailer" field of the sendmail output, in this case, its "esmtp" meaning forward that mail to the next server or send that mail to the server if it was generated locally. Look for the "mailer local" responce to send the user to spamc, anything else, send the -u preference to spamc. Note that the mailmam program will give these results:

sendmail -bv -email is unavailable-
"|/var/mailman/mail/mailman post test-annoucementandart"... deliverable: mailer prog, user "|/var/mailman/mail/mailman post test-annoucementandart"

spamd[15262]: handle_user: unable to find user '"|/var/mailman/mail/mailman post test-annoucementandart"'!

In this case, "|/var/mailman/mail/mailman post test-annoucementandart" is send to spamc, including the quotes. Luckfully, it doesn't crash on that bad username input.

This is why I sujest looking for "local" and rejecting anything else as non-local user and use "-u" preference to send to spamc.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by gdt (Posted a comment)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-08-01 gdt Severity3 - Normal 4 - Important
    2005-10-06 dnelson Assigned toNone dnelson

    Back to the top

    Powered by Savane 3.12.
    Corresponding source code