Mail Essentials reveals identity of first BCC recipient

From: Ronan Waide (ronan.waideat_private)
Date: Wed Dec 12 2001 - 01:55:18 PST

  • Next message: Marcelo Bartsch: "Re: UDP DoS attack in Win2k via IKE" 

    Hi Bugtraqers,

I recently received a marketing mail from a supplier who uses an email
content filter called Mail Essentials from GFI Software (see
http://www.gfisoftware.com/me/mesfeatures.htm for more
information). The message had no destination address, having been sent
to a BCC list. On inspecting the Received: headers, I found one
inserted by Mail Essentials:

Received: From mail.server by other.server
	Mail essentials (server 2.422) with SMTP id: <513at_private>
	 for <bcc_person@address>; Wed, 29 Aug 2001 16:19:12 +0100
	smtpmailfrom <originator@address> 

The 'bcc_person@address' was, presumably, the first person on the BCC
list - it certainly wasn't /my/ address. I brought this to the
attention of GFI software over a month ago, and the eventual response
was to the effect that 'BCC headers get stripped out' - evidently the
problem was misunderstood. Since I've not heard anything more from
them after clarifying the situation, I'm posting the problem here in
case anyone happens to use this software in-house.

Cheers,
Waider.
-- 
Ronan Waide / Unix Guy / euroConex Technologies Ltd.

    This archive was generated by hypermail 2b30 : Wed Dec 12 2001 - 08:34:57 PST