From owner-freebsd-security  Wed Jun 20 15:47:30 2001
Delivered-To: freebsd-security@freebsd.org
Received: from ns1.via-net-works.net.ar (ns1.via-net-works.net.ar [200.10.100.10])
	by hub.freebsd.org (Postfix) with ESMTP id 3887A37B401
	for <freebsd-security@FreeBSD.ORG>; Wed, 20 Jun 2001 15:47:26 -0700 (PDT)
	(envelope-from fschapachnik@vianetworks.com.ar)
Received: (from fpscha@localhost)
	by ns1.via-net-works.net.ar (8.9.3/8.9.3) id TAA21939;
	Wed, 20 Jun 2001 19:47:13 -0300 (ART)
X-Authentication-Warning: ns1.via-net-works.net.ar: fpscha set sender to fschapachnik@vianetworks.com.ar using -f
Date: Wed, 20 Jun 2001 19:47:13 -0300
From: "Fernando P . Schapachnik" <fschapachnik@vianetworks.com.ar>
To: Erick Mechler <emechler@techometer.net>
Cc: faSty <fasty@i-sphere.com>, freebsd-security@FreeBSD.ORG
Subject: Re: need help filter this stupid virus. Sendmail didnt stop this.
Message-ID: <20010620194713.A18467@ns1.via-net-works.net.ar>
References: <20010620152023.C19358@i-sphere.com> <20010620153507.P73138@techometer.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
User-Agent: Mutt/1.2.5i
In-Reply-To: <20010620153507.P73138@techometer.net>; from emechler@techometer.net on Wed, Jun 20, 2001 at 03:35:07PM -0700
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

En un mensaje anterior, Erick Mechler escribió:
> You don't need the from.  For example, try this:
> 
> [emechler@lucifer ~]$ cat /etc/mail/access
> hahaha@sexyfun.net	REJECT

It won't work, as the virus uses hahaha@sexyfun.net INSIDE the
message itself and sendmail checks the From field from the envelope,
which in this case is probably <> (empty).

I was about to report it as a bug to sendmail a few days ago, but
then I thought there might be some option to change that behavior or
some valid reason for sendmail to accept a empty mail from:. I
haven't had time to research since then.

Regards.


Fernando P. Schapachnik
Planificación de red y tecnología
VIA NET.WORKS ARGENTINA S.A.
fschapachnik@vianetworks.com.ar
Tel.: (54-11) 4323-3381

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message