Please fix your e-mail system

[Valdis.Kletnieks () vt edu]

Mail goes from the list to a subscriber at the af.mil address - and the
Exchange server does the obviously broken thing and tries to send it back to
the RFC822 cc: field, instead of doing what it's supposed to do and deliver it
to the RFC821 'RCPT TO:' (which it knows - see the first Received: header has
the 'for <destination>' in it, and sending bounces back to the RFC821 MAIL
FROM:

Obligatory Full-Disclosure tie-in:  Here we have an obviously misconfigured
mail system inside the 'af.mil' domain.  Three of the servers were even nice
enough to identify their exact patch levels (It appears that 2 of them are
still at .211 rather than .1830).  How many different ways can you think of to
leverage the information in the Received: headers into a full-scale intrusion?

I already know why *I* know all this - anybody care to guess how? (The list
managers are ineligible for this one.. ;)

Received: from fsjubj14.exchange.gunter.af.mil (FSJUBJ14.exchange.gunter.af.mil [143.158.200.214])
        by lists.grok.org.uk (Postfix) with ESMTP id BE8847D4
        for <full-disclosure () lists grok org uk>; Fri, 20 May 2005 18:55:39 +0100 (BST)
Received: from fsjubj12.exchange.gunter.af.mil ([143.158.200.212]) by fsjubj14.exchange.gunter.af.mil with Microsoft 
SMTPSVC(6.0.3790.211);
         Fri, 20 May 2005 12:55:38 -0500
Received: from mail pickup service by fsjubj12.exchange.gunter.af.mil with Microsoft SMTPSVC;
         Fri, 20 May 2005 12:55:29 -0500
Received: from fsjubj13.exchange.gunter.af.mil ([143.158.200.213]) by fsjubj12.exchange.gunter.af.mil with Microsoft 
SMTPSVC(6.0.3790.211);
         Fri, 20 May 2005 11:12:49 -0500
Received: from smtpgw1.gunter.afmc.ds.af.mil ([143.158.253.9]) by fsjubj13.exchange.gunter.af.mil with Microsoft 
SMTPSVC(6.0.3790.1830);
         Fri, 20 May 2005 11:12:48 -0500
Received: from lists.grok.org.uk ([195.184.125.51])
 by smtpgw1.gunter.afmc.ds.af.mil (SAVSMTP 3.1.1.32) with SMTP id M2005052011053121905
 for <suzanne.vanpatten () gunter af mil>; Fri, 20 May 2005 11:05:31 -0500

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/