OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: [suse-security] sendmail ftp bug?
From: Irmund Thum (irmund.thumpp-active.de)
Date: Wed Oct 04 2000 - 13:36:45 CDT

 2. and 3. Oktocer we had on a FTP-Server a surprising visit and an
abuse of sendmail:

*** log extract ***
Oct 2 23:02:04 ftp sendmail[12220]: XAA12220: SYSERR: putoutmsg
(ipb194.miami15.fl.pub-ip.psi.net): error on output channel sending "250
kbrabowmail.win.org... Recipient ok": Broken pipe
Oct 2 23:03:13 ftp sendmail[12232]: XAA12232: collect: premature EOM:
Connection reset by ipb194.miami15.fl.pub-ip.psi.net
Oct 2 23:03:13 ftp sendmail[12232]: XAA12232: SYSERR(root): collect:
I/O error on connection from ipb194.miami15.fl.pub-ip.psi.net,
from=<billbukrhein-neckar.de>: Connection reset by
ipb194.miami15.fl.pub-ip.psi.net
Oct 2 23:07:01 ftp sendmail[12291]: XAA12291: collect: premature EOM:
Connection reset by ipb194.miami15.fl.pub-ip.psi.net
Oct 2 23:07:01 ftp sendmail[12291]: XAA12291: SYSERR(root): collect:
I/O error on connection from ipb194.miami15.fl.pub-ip.psi.net,
from=<billbukrhein-neckar.de>: Connection reset by
ipb194.miami15.fl.pub-ip.psi.net
Oct 2 23:10:36 ftp sendmail[12308]: XAA12308: SYSERR: putoutmsg
(ipb194.miami15.fl.pub-ip.psi.net): error on output channel sending "250
mozesxentrix.net... Recipient ok (will queue)": Broken pipe
Oct 2 23:33:30 ftp sendmail[13022]: XAA13022: SYSERR: putoutmsg
(ipb194.miami15.fl.pub-ip.psi.net): error on output channel sending "250
doeserver.net... Recipient ok (will queue)": Broken pipe
Oct 2 23:36:13 ftp sendmail[13052]: XAA13052: SYSERR: putoutmsg
(ipb194.miami15.fl.pub-ip.psi.net): error on output channel sending "250
barbaradropfatgetthin.com... Recipient ok (will queue)": Broken pipe
Oct 3 04:58:17 ftp sendmail[17551]: EAA17551: SYSERR: putoutmsg
(ipb145.miami15.fl.pub-ip.psi.net): error on output channel sending "250
<jogunzaaamart.co.jp>... Sender ok": Broken pipe
Oct 3 09:45:23 ftp sendmail[19163]: JAA19163: collect: premature EOM:
Connection reset by ipa247.miami15.fl.pub-ip.psi.net
Oct 3 09:45:23 ftp sendmail[19163]: JAA19163: SYSERR(root): collect:
I/O error on connection from ipa247.miami15.fl.pub-ip.psi.net,
from=<jimilesdenilesad.oita-u.ac.jp>: Connection reset by
ipa247.miami15.fl.pub-ip.psi.net
Oct 3 12:01:43 ftp sendmail[21313]: LAA21313: collect: premature EOM:
Connection reset by ipa247.miami15.fl.pub-ip.psi.net
Oct 3 12:01:44 ftp sendmail[21313]: LAA21313: SYSERR(root): collect:
I/O error on connection from ipa247.miami15.fl.pub-ip.psi.net,
from=<jimilesdenilesad.oita-u.ac.jp>: Connection reset by
ipa247.miami15.fl.pub-ip.psi.net
Oct 3 12:03:35 ftp sendmail[21390]: MAA21390: SYSERR: putoutmsg
(ipa247.miami15.fl.pub-ip.psi.net): error on output channel sending "250
halaintermediatn.net... Recipient ok (will queue)": Broken pipe
Oct 3 12:09:14 ftp sendmail[21478]: MAA21478: SYSERR: putoutmsg
(ipa247.miami15.fl.pub-ip.psi.net): error on output channel sending "250
elizabethexfuse.net... Recipient ok (will queue)": Broken pipe
Oct 3 13:35:20 ftp sendmail[22832]: NAA22800: smtp.vphos.net.: SMTP
DATA-2 protocol error: 570 Command DATA Message rejected due to content
Oct 3 18:57:23 ftp sendmail[26457]: SAA26457: SYSERR: putoutmsg
(ipa178.miami15.fl.pub-ip.psi.net): error on output channel sending "250
wandaadsnet.com... Recipient ok": Broken pipe

***

message body was a typical "get rich quick scheme":

*** extract ***

I AM LIVING PROOF THAT IT WORKS!!! If you choose not to
participate in this program, I am sorry. It really is a great
opportunity with little cost or risk to you. If you choose to
participate, follow the program and you will be on your way to
financial security. If you are a fellow business owner and are in
financial trouble like I was, or you want to start your own business,

consider this a sign. I DID! $$

Sincerely,

Johnathon Rourke

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

HERE'S HOW THIS AMAZING PROGRAM WILL MAKE YOU
THOUSANDS OF DOLLAR$$$$!!!!

PLAN SUMMARY:

(1) You order the 4 reports listed below ($5 each). They come to
you by email.

(2) Save a copy of this entire letter and put your name after
Report #1 and move the other names down.

(3) Use any of the hundreds of bulk email services (search for
"Bulk Email") and have them send 25,000 - 50,000 emails for you
(about $49+)

(4) Orders will come to you by postal mail - simply email them the
Report they ordered.

*** etc . ***

Can somenody give me a hint or point me to a documentation?
Thanks,
i.t 

-- 
Mit freundlichen Gruessen
Irmund Thum, PP Active GmbH
Candidplatz 11, 81543 Muenchen
tlf +49 89 748828 43, fax...-11

---------------------------------------------------------------------
To unsubscribe, e-mail: suse-security-unsubscribesuse.com
For additional commands, e-mail: suse-security-helpsuse.com