Re: [ietf-822] inventive syntax, at least

"John Levine" <johnl@taugh.com> Sat, 15 November 2014 04:18 UTC

Date: Sat, 15 Nov 2014 04:18:02 -0000
Message-ID: <20141115041802.11249.qmail@ary.lan>
From: John Levine <johnl@taugh.com>
To: ietf-822@ietf.org
In-Reply-To: <dde9e95a0cbeb42be10c0cba26016c2d@mailbox.ijs.si>
Organization:
Mime-Version: 1.0
Content-type: text/plain; charset="utf-8"
Content-transfer-encoding: 8bit
Archived-At: http://mailarchive.ietf.org/arch/msg/ietf-822/Jzg1v2nDAA0XHnfo3OjEH-5bzgE
Cc: Mark.Martinec+ietf@ijs.si
Subject: Re: [ietf-822] inventive syntax, at least
Precedence: list

In article <dde9e95a0cbeb42be10c0cba26016c2d@mailbox.ijs.si> you write:
>Arnt Gulbrandsen wrote:
>> On Wednesday, November 12, 2014 7:24:44 PM CEST, Murray S. Kucherawy 
>> wrote:
>>> Looks vaguely like the recent bash attack.
>> 
>> Yes. It's trying to see whether anyone's handling To, References, Cc,
>> From, Subject, Date, Message-ID, Comments, Keywords, Resent-Date,
>> Resent-From or Resent-Sender using bash. But is anyone falling for it?
>> I'm curious.
>
>Yes, apparently qmail:
>   qmail is a vector for CVE-2014-6271 (bash "shellshock")
>   http://www.gossamer-threads.com/lists/qmail/users/138578

Depends how your computer is set up.  Qmail uses /bin/sh for command
deliveries, and it puts parameters in environment variables, so if
your /bin/sh is actually bash (a bad idea but very common on linux
systems) bad stuff can happen.

I would think that sendmail and postfix .forward files would have the
same problem.

[ietf-822] inventive syntax, at least Arnt Gulbrandsen
Re: [ietf-822] inventive syntax, at least Murray S. Kucherawy
Re: [ietf-822] inventive syntax, at least Arnt Gulbrandsen
Re: [ietf-822] inventive syntax, at least Mark Martinec
Re: [ietf-822] inventive syntax, at least John Levine
Re: [ietf-822] inventive syntax, at least Mark Martinec
Re: [ietf-822] inventive syntax, at least Martijn Grooten
Re: [ietf-822] inventive syntax, at least Arnt Gulbrandsen