From owner-freebsd-security  Fri Mar 21  3:10:27 2003
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5AE3337B401
	for <freebsd-security@FreeBSD.ORG>; Fri, 21 Mar 2003 03:10:26 -0800 (PST)
Received: from mail-pm.star.spb.ru (mail-pm.star.spb.ru [217.195.82.1])
	by mx1.FreeBSD.org (Postfix) with ESMTP id DAB9D43F85
	for <freebsd-security@FreeBSD.ORG>; Fri, 21 Mar 2003 03:10:24 -0800 (PST)
	(envelope-from nkritsky@internethelp.ru)
Received: from pink.star.spb.ru ([217.195.82.10])
	by mail-pm.star.spb.ru (8.12.8/8.12.8) with ESMTP id h2LBAMeQ031146
	for <freebsd-security@FreeBSD.ORG>; Fri, 21 Mar 2003 14:10:22 +0300 (MSK)
Received: from IBMKA ([217.195.82.7]) by pink.star.spb.ru with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2653.13)
	id HFKCP7HH; Fri, 21 Mar 2003 14:10:22 +0300
Date: Fri, 21 Mar 2003 14:10:17 +0300
From: "Nickolay A. Kritsky" <nkritsky@internethelp.ru>
X-Mailer: The Bat! (v1.49) Personal
Reply-To: "Nickolay A. Kritsky" <nkritsky@internethelp.ru>
X-Priority: 3 (Normal)
Message-ID: <103856076392.20030321141017@internethelp.ru>
To: freebsd-security@FreeBSD.ORG
Subject: (OT) Sendmail exploit?
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

   Hi, freebds-security.

  Sorry for possible off-topic.
  Today I have found something new in my daily.local mail:

;-----------Clipboard starts here-------------------------------
Checking for rejected mail hosts:
   3
  <ltwypslknyyzztzxgyfsgvfulzmaivcjqgiwedpjiulpzeuvelsckuukfbwzuozcghnyrteaembsafxsmtqgybottylczcbmdcqdxbzjhwquhwfgqznjgknloeetiieowywjhnoezpqrwlyjsitsdmjxhwmyeqlrmnnulmhbtyzztvphjexprxomuagfquflvmulnjhmgycsvfxpafknkfkgzgztuabzhxzqzllsfiyqwkvhqfwzizve
;-----------Clipboard ends here---------------------------------

And 7 another similiar (but not identical) strings.

This looks like some kind of attack to me. Does anybody know about
such attempts? I was thinking that new sendmail vuln is exploited w/
strings like '<><><><><><>'. Sendmail is patched, all systems are
(apparently) working fine, just curious.

;-------------------------------------------
; NKritsky
; mailto:nkritsky@internethelp.ru



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message