Hi, today I had some messages with the following headers on one of my mail servers . Ill formatted spam or sendmail exploit in the wild ? -- Dominik Samuelis ----------- message1---------- From shopdirect@snail-mail.net Mon Mar 10 14:15:50 2003 X-UIDL: 1*m!!l*H"!_p8!!a0/!! Return-Path: <shopdirect@snail-mail.net> Received: from sm21.localdomain ([206.40.229.121]) by smtpsrv.campanova.net (8.12.8/8.12.8) with ESMTP id h2ADFYhY013371 for <xxxat_private>; Mon, 10 Mar 2003 14:15:45 +0100 Received: from unknown Date: Mon, 10 Mar 2003 06:15:06 -0700 (MST) Message-Id: <200303101315.h2ADF6l0026203at_private> Comments: Received: from Pb>;7F=o2@=]4@>|>6:36=EDoDDD?6E]4@>Nz B Received: from Jx3FEE6C7=J:?5o;F?@]4@>|36?oAF3=:D:E6]36|?2?4J]>:49 @?o?2D9G:==6]4@>|>:?6CG2o>:?6CG2:?4]4@>|:?G@:4:?8 oK:Aa]4@>|25=6Co>24BF2C:F>]4@>Tx M Received: from Ma;@9?oC6?@]BF:<]4@>|>:4<=6o>2:=]4@>>@?=:?<]4@>|563 3:6o?6E\C6D@FC46]4@>|7C2?4:Do>2:=]>:?8A2@]4@>|72F D6Jo49:=<2ED@7E]4@>|52G6]42C=D@?o?6EH@C<D4@>]4@>Tv T Received: from Tu5>442CE9JoA3]?6E|>C\>CDo86@4:E:6D]4@>|8?oD5G]7C|> @>@?6Jo>@>@?6J]4@>|9@DE>2DE6Co6?E@C?@]6D|;:>>FCA9 J`o2@=]4@>Tq R Received: from Ac49C:Do3=@>36C8]?6E|C2=3@?oD5:4]?6E|>E?35Jo2==H6DE ]?6E|D49>:5Eo42>A2?@G2]56|9@DE>2DE6Co>:5H6DE:D]?6 E|>6>46?E6Co>6>AC@]H:?]?6ETz G Received: from RmG6?F496<o6C@=D]4@>|3D49J>FC2o@C:8:?6E]4@>]3C|2=6I oA:=2EFD56D:8?D]4@>|DF?D:?oAF3]K9@?8D92?]85]4?|6> 6?56=o36DE]4@>|<66A6Co4J3CK?]4@>Mr Z Received: from Nr432=E2K2Co8@7:=?6E]4@>|82==A6E6Co4@>AFD6CG6]4@>|5 FDE32<oIDc2==]?=|G;3o?6E=23D]?6E|>A56D:8?o36DE]4@ >|C@@EoD6:?6E]:ETT T Received: from Nz>@I?I`o62CE9=:?<]?6E|;482=G6Ko9@=@?6E]?6E|392==oD J?6C8J:?E]4@>|E=>45@H6==oJ29@@]4@>|`_d_ba]adceo4@ >AFD6CG6]4@>|5>2EE96HDo>AD4@>A2?J]4@>Rb Y Received: from PQ>G2=G2?@o82C=@4<\:?4]4@>|4DDoE2C86E]?6E|@=:D2EK86 Co2@=]4@>|2CG:?50DFE92Co3:87@@E]4@>|C6D:DEC2CoE96 C@4<:6D]4@>|;@6oD2G2C5]?6ERz M Errors: shopdirect@snail-mail.net From: Free Overnight Shipping <shopdirect@snail-mail.net> To: No Prescription Needed <moreland6512at_private> Subject: Online Pharmacy Free Shipping MIME-Version: 1.0 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Status: RO <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN [... normal spam body follows...] ---------------------------------------------------------------------------- <Pre>Lose another weekend managing your IDS? Take back your personal time. 15-day free trial of StillSecure Border Guard.</Pre> <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>
This archive was generated by hypermail 2b30 : Tue Mar 11 2003 - 09:17:27 PST