Bugtraq mailing list archives
Re: CORRECTION to CODE: FormMail.pl can be used to send anonymous email
From: Steve Reid <sreid () SEA-TO-SKY NET>
Date: Mon, 12 Mar 2001 02:43:02 -0800
On Sat, Mar 10, 2001 at 05:43:43PM +0000, Michael Rawls wrote:
I did a little playing with FormMail.pl after a run in with a spammer abusing our webserver. Apparently ALL FormMail.pl cgi-bin scripts can be used to spam anonymously. I found another server with FormMail.pl and tried the same exploit to send myself an email and it worked.
There are several different versions of formmail.pl floating around. I've seen one that did absolutely no checking at all, and one that would not send mail to any host not listed in /etc/hosts, and a couple of others with peculiarities I can't recall. Formmail.pl is a very short and simple script, which makes it easy to understand and therefor easy to modify. I wouldn't guess at how many variants are out there. Given the existence of these variants, I believe the perils of formmail.pl have been known about for a long time. The original probably had no spam protection at all, and everyone who discovered that fact created their own variant. A bugtraq database search brings up several hits going back as far as 1995, although none of them appear to be of the type you have reported.
Current thread:
- CORRECTION to CODE: FormMail.pl can be used to send anonymous email Michael Rawls (Mar 11)
- Re: CORRECTION to CODE: FormMail.pl can be used to send anonymous email Palmans Pepijn (Mar 12)
- Re: CORRECTION to CODE: FormMail.pl can be used to send anonymous email Joel Sing (Mar 12)
- Re: CORRECTION to CODE: FormMail.pl can be used to send anonymous email Steffen Dettmer (Mar 12)
- Re: CORRECTION to CODE: FormMail.pl can be used to send anonymous email Steve Reid (Mar 13)
- Re: CORRECTION to CODE: FormMail.pl can be used to send anonymousemail Scott Buchanan (Mar 12)
- Message not available
- Re: CORRECTION to CODE: FormMail.pl can be used to send anonymousemail Scott Buchanan (Mar 13)
- Message not available
- Re: CORRECTION to CODE: FormMail.pl can be used to send anonymous email Steve Reid (Mar 12)