Re: Several new CGI vulnerabilities

From: Randal Schwartz (merlynat_private)
Date: Mon Nov 09 1998 - 18:45:28 PST

  • Next message: Andi Kleen: "Re: Sendmail, lynx, Netscape, sshd, Linux kernel (twice)"

    >>>>> "xnec" == xnec  <xnecat_private> writes:
    
    xnec> Either fork your sendmail process, strip out metacharacters (or
    xnec> only allow certian characters),
    
    You cannot restrict the permitted characters of an email address.
    *Any* character is permitted on the left-side of an @, presuming
    the proper quoting is used for those more odd ones.
    
    For example, <fred&barneyat_private> is a perfectly valid
    email address (try it, an autoresponder responds!).
    
    xnec>  use open (MAIL , "|$sendmail -t") or rm -rf
    xnec> ./cgi-bin.
    
    Or use Net::SMTP to pass the data directly to port 25.
    
    --
    Name: Randal L. Schwartz / Stonehenge Consulting Services (503)777-0095
    Keywords: Perl training, UNIX[tm] consulting, video production, skiing, flying
    Email: <merlynat_private> Snail: (Call) PGP-Key: (finger merlynat_private)
    Web: <A HREF="http://www.stonehenge.com/merlyn/">My Home Page!</A>
    Quote: "I'm telling you, if I could have five lines in my .sig, I would!" -- me
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:22:40 PDT