procmail
[Top] [All Lists]

procmail/smail security interaction

1996-05-07 04:14:36
I am using "/\oo/\ Smail3.1.29.1 #29.3" on Linux 1.3.76 (and I've also
verified the following information with kernel 1.2.13).

My smail configuration is the Linux binary configuration out of the box
except for host and domain names, a smarthost and smartuser director,
and using "procmail v3.10 1994/10/31" for the local delivery agent as
follows (from the smail "transports" file):

local: return_path, local, from, driver=pipe; user=root,
        cmd="/usr/local/bin/procmail -d $($user$)"

This works fine in general.

However, I had some hardware problems with my host, moved to a
different one, and when I moved back I just copied all my home
directory files across, including a .forward file containing only

"| /usr/local/bin/procmail"

procmail proceeded to deliver all mail addressed to "turnbull" to
"root".  This looks like an "oops" to me!  I don't know whether it can
be exploited, but....  I don't know what would happen with Sendmail, I
don't have it installed.

-- 
                           Stephen John Turnbull
University of Tsukuba                                        Yaseppochi-Gumi
Institute of Socio-Economic Planning       http://turnbull.sk.tsukuba.ac.jp/
Tennodai 1-1-1, Tsukuba, 305 JAPAN                 
turnbull(_at_)sk(_dot_)tsukuba(_dot_)ac(_dot_)jp

<Prev in Thread] Current Thread [Next in Thread>
  • procmail/smail security interaction, Stephen J. Turnbull <=