Re: Several new CGI vulnerabilities

merlynSTONEHENGE.COM

• Messages sorted by: [ date ][ thread ][ subject ][ author ]
• Next message: Lincoln Stein: "Re: Several new CGI vulnerabilities"
• Previous message: Wietse Venema: "Re: tcpd -DPARANOID doesn't work, and never did"
• In reply to: xnec: "Several new CGI vulnerabilities"

>>>>> "xnec" == xnec  <xnecWINTERMUTE.LINUX.TC> writes:

xnec> Either fork your sendmail process, strip out metacharacters (or
xnec> only allow certian characters),

You cannot restrict the permitted characters of an email address.
*Any* character is permitted on the left-side of an , presuming
the proper quoting is used for those more odd ones.

For example, <fred&barneystonehenge.com> is a perfectly valid
email address (try it, an autoresponder responds!).

xnec>  use open (MAIL , "|$sendmail -t") or rm -rf
xnec> ./cgi-bin.

Or use Net::SMTP to pass the data directly to port 25.

--
Name: Randal L. Schwartz / Stonehenge Consulting Services (503)777-0095
Keywords: Perl training, UNIX[tm] consulting, video production, skiing, flying
Email: <merlynstonehenge.com> Snail: (Call) PGP-Key: (finger merlynteleport.com)
Web: <A HREF="http://www.stonehenge.com/merlyn/">My Home Page!</A>
Quote: "I'm telling you, if I could have five lines in my .sig, I would!" -- me

• Next message: Lincoln Stein: "Re: Several new CGI vulnerabilities"
• Previous message: Wietse Venema: "Re: tcpd -DPARANOID doesn't work, and never did"
• In reply to: xnec: "Several new CGI vulnerabilities"