Subject: "POSSIBLE ATTACK" messages from sendmail -- what gives?

From: macferrin@slsiris2 (Kurtis MacFerrin)
Date: 26 Apr 1995 01:25:12 GMT

Hi!
	When sending to several addresses at once, sendmail (8.6.10 on irix
4.0.5F) logs an error message saying something like POSSIBLE ATTACK, newline
in address. I'm using pine (3.91).
	Anything I should do about this? The actual log entry follows:
[sorry it's >80 chars wide]

oSYSLOG:Apr 19 20:09:05 slsiris sendmail[4980]: POSSIBLE ATTACK from macferrin@localhost: newline in string "Poker <[email-masked]>, David Peritz <[email-masked]>,      Delia Graff <[email-masked]>, [email-masked],      Jason Abrevaya <[email-masked]>,      Michael Glanzberg <[email-masked]>,  Mike Zilles <[email-masked]>, Sanford Shieh <[email-masked]>,      [email-masked]"

	Thanks!
Kurtis MacFerrin	[email-masked]

---

From: [email-masked]
Date: Wed, 26 Apr 1995 11:25:17 +0100 (BST)

On 26 Apr 1995, Kurtis MacFerrin wrote:

This is a known problem with pine/sendmail.  Pine is doing nothing wrong 
- it is conforming to RFC822 in allowing continuation lines in fields as 
long as they are indented.  

This syslog comes about because versions of sendmail previous to 8.6.9 
had a major security problem in it with newlines appearing in the From 
line.  Therefore Eric Allman (who wrote sendmail), got sendmail to log 
this as a warning to sysadmins.  This was seen as a problem in 8.6.9 and 
the code was changed slightly in 8.6.10 to try to stop these spurious 
messages.  This did not always work so it was changed again.

The message is nothing to be worried about but you still need to be 
vigilent as someone could use the security hole to "break" into your machine.

The latest version of sendmail is 8.6.12 and I would suggest that you get 
this.  This seems to be better at trapping some of these spurious 
warnings and also fixes anothe security problem with the use of the IDENT 
protocol.

> Kurtis MacFerrin	[email-masked]

----
Stuart Tares			Email : [email-masked]
Senior Network Analyst		Voice : +44 181 742 4060
DHL Systems Ltd, CSG Europe & Africa Region

---

From: [email-masked] (Jason Haar)
Date: 26 Apr 1995 08:17:03 GMT

> oSYSLOG:Apr 19 20:09:05 slsiris sendmail[4980]: POSSIBLE ATTACK from macferrin@localhost: newline in string "Poker <[email-masked]>, David Peritz <[email-masked]>,      Delia Graff <[email-masked]>, [email-masked],      Jason Abrevaya <abrevay
[email-masked]>,      Michael Glanzberg <[email-masked]>,  Mike Zilles <[email-masked]>, Sanford Shieh <[email-masked]>,      [email-masked]"

Upgrade to sendmail-8.6.12 - it was altered to stop logging long 
addresses generated by the likes of pine.

--

Cheers,

Jason
+------------------------------+------------------------------------------+
| Jason Haar, European SysAdmin   Phone: + 44 (256) 790577                |
| Motorola Cellular Subscriber      Fax: + 44 (256) 790519                |
| Basingstoke, Hampshire                                                  |
| RG21 1PL,  ENGLAND           Internet: [email-masked] |
+------------------------------+------------------------------------------+

---

From: [email-masked] (Chris Mauritz)
Date: Wed, 26 Apr 1995 08:50:44 GMT

Kurtis MacFerrin (macferrin@slsiris2) wrote:

: Hi!
: 	When sending to several addresses at once, sendmail (8.6.10 on irix
: 4.0.5F) logs an error message saying something like POSSIBLE ATTACK, newline
: in address. I'm using pine (3.91).
: 	Anything I should do about this? The actual log entry follows:
: [sorry it's >80 chars wide]

: oSYSLOG:Apr 19 20:09:05 slsiris sendmail[4980]: POSSIBLE ATTACK from macferrin@localhost: newline in string "Poker <[email-masked]>, David Peritz <[email-masked]>,      Delia Graff <[email-masked]>, [email-masked],      Jason Abrevaya <[email-masked]>,      Michael Glanzberg <[email-masked]>,  Mike Zilles <[email-masked]>, Sanford Shieh <[email-masked]>,      [email-masked]"

It's probably one of your users running pine, which makes 8.6.10 unhappy
with the To: header when the sender sends email to more than one recipient.
Just get the latest version of sendmail (I believe we're up to 8.6.12?)
and the problem goes away.  :)

Regards,

Chris

-- 
Christopher Mauritz         | For info on internet access:
[email-masked]             | finger/mail [email-masked] OR
Mordor International        | http://www.mordor.com/
201/212/718 internet access | Modem: (201)433-7343,(212)843-3451