Subject: [ietf-822] inventive syntax, at least

From: Arnt Gulbrandsen <[email-masked]>
Date: Wed, 12 Nov 2014 19:16:37 +0100

Someone's spamming the globe with messages like this:

  References:() { :; };wget ....

There are about 15 header fields, all alike. I'm curious. Do any of you 
know whether anyone is falling for it?

Arnt

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 12 Nov 2014 08:24:44 -1000

Looks vaguely like the recent bash attack.

On Wed, Nov 12, 2014 at 8:16 AM, Arnt Gulbrandsen <[email-masked]>
wrote:

> _______________________________________________
> ietf-822 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-822
>

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Wed, 12 Nov 2014 19:28:39 +0100

> Looks vaguely like the recent bash attack.

Yes. It's trying to see whether anyone's handling To, References, Cc, From, 
Subject, Date, Message-ID, Comments, Keywords, Resent-Date, Resent-From or 
Resent-Sender using bash. But is anyone falling for it? I'm curious.

Arnt

---

From: Mark Martinec <[email-masked]>
Date: Thu, 13 Nov 2014 14:46:28 +0100

Arnt Gulbrandsen wrote:
> Yes. It's trying to see whether anyone's handling To, References, Cc,
> From, Subject, Date, Message-ID, Comments, Keywords, Resent-Date,
> Resent-From or Resent-Sender using bash. But is anyone falling for it?
> I'm curious.

Yes, apparently qmail:
   qmail is a vector for CVE-2014-6271 (bash "shellshock")
   http://www.gossamer-threads.com/lists/qmail/users/138578

http://en.wikipedia.org/wiki/Shellshock_(software_bug)#Qmail_server

   Mark

---

From: "John Levine" <[email-masked]>
Date: 15 Nov 2014 04:18:02 -0000

>   http://www.gossamer-threads.com/lists/qmail/users/138578

Depends how your computer is set up.  Qmail uses /bin/sh for command
deliveries, and it puts parameters in environment variables, so if
your /bin/sh is actually bash (a bad idea but very common on linux
systems) bad stuff can happen.

I would think that sendmail and postfix .forward files would have the
same problem.

---

From: Mark Martinec <[email-masked]>
Date: Sat, 15 Nov 2014 11:49:40 +0100

> I would think that sendmail and postfix .forward files would have the

Postfix is not a vector for shellshock, explicitly stated here:
   http://marc.info/?l=postfix-users&m=141461595214262

Don't know about sendmail, although we would probably hear
about it by now if it were.

   Mark

---

From: Martijn Grooten <[email-masked]>
Date: Sat, 15 Nov 2014 10:52:47 +0000

> I would think that sendmail and postfix .forward files would have the

Exim too, apparently

http://blog.trendmicro.com/trendlabs-security-intelligence/shellshock-related-attacks-continue-targets-smtp-servers/

I haven't heard of any successful attacks, but then, if you still
haven't patched bash, you're probably not checking your servers for
possible malware infections either.

Martijn.

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Sat, 15 Nov 2014 12:20:49 +0100

> I would think that sendmail and postfix .forward files would have the

Postfix doesn't write GIGO crap to environment variables. Qmail's general 
philosophy is to not parse and thereby shrink its own attack surface, 
Postfix' is to parse and think about the result.

Postfix will write e.g. the recipient localpart to the environment, so if 
your login name were (){etc I suppose Postfix would be vulnerable in your 
case.

No idea about sendmail, I haven't used that since the days of 5.65.

Arnt