Re: [sa] Re: End of Thread [Was: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt]

2010-03-09 Thread Charles Gregory
On Tue, 9 Mar 2010, Ned Slider wrote: It's clear you either haven't read or haven't understood what Kai wrote, which btw was spot on. More attitude. Yeesh. Kai has an opinion. And in fairness, I give his arguments some serious weight. It's not black-n-white. But this attitude that he/you

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Robert Brooks
Brian wrote: I'm glad you like amavis-new. I found it to scale poorly and a single, common point of failure and fall into the category that is commonly called 'bloat'. It does illustrate all the missing features of Postfix in quite a handy example - so thanks for mentioning it. there's a

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Ralf Hildebrandt
* Kai Schaetzl mailli...@conactive.com: package doesn't. For good reasons. We don't want bloatware and we may want updates on that plugin much more often then we want updates on the MTA. I really do not want to update my MTA time and again because it's got a new policy feature. Postfix

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Yet Another Ninja
On 2010-03-09 13:51, Brian wrote: On Tue, 2010-03-09 at 13:17 +0100, Ralf Hildebrandt wrote: * Brian brel.astersik100...@copperproductions.co.uk: In the year 2010 it is not unreasonable to expect the MTA that takes responsibility for accepting a message to make reasonable checks about the

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Brian
On Tue, 2010-03-09 at 13:00 +, Robert Brooks wrote: Brian wrote: On Tue, 2010-03-09 at 13:17 +0100, Ralf Hildebrandt wrote: * Brian brel.astersik100...@copperproductions.co.uk: In the year 2010 it is not unreasonable to expect the MTA that takes responsibility for accepting a

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Ned Slider
Brian wrote: On Tue, 2010-03-09 at 14:04 +0100, Yet Another Ninja wrote: to stay on the Postfix 'merry-go-round' for an answer, or we can just agree Postfix can't easily do this and move on and stop flogging this dead horse :-) good idea - Here, its totally off topic. Move it to Postfix

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Brian
On Tue, 2010-03-09 at 13:24 +, Robert Brooks wrote: Brian wrote: On Tue, 2010-03-09 at 13:00 +, Robert Brooks wrote: Brian wrote: On Tue, 2010-03-09 at 13:17 +0100, Ralf Hildebrandt wrote: * Brian brel.astersik100...@copperproductions.co.uk: In the year 2010 it is not

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Kai Schaetzl
Brian wrote on Tue, 09 Mar 2010 06:51:45 +: Yes, but that does not answer my question {and is once more Postfix biased} AFAIK Postfix is totally unable to reject mail at SMTP time that Spamassassin decides IS SPAM without the aid of a milter or policy deamon of some kind. You have a very

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Robert Brooks
Brian wrote: On Tue, 2010-03-09 at 13:00 +, Robert Brooks wrote: Brian wrote: On Tue, 2010-03-09 at 13:17 +0100, Ralf Hildebrandt wrote: * Brian brel.astersik100...@copperproductions.co.uk: In the year 2010 it is not unreasonable to expect the MTA that takes responsibility for accepting

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Brian
On Tue, 2010-03-09 at 14:45 +0100, Ralf Hildebrandt wrote: * Brian brel.astersik100...@copperproductions.co.uk: So Ralf - author of 'The Postfix Book', can you please now tell me how to get Postfix to reject mail before it accepts it and gives a 250 - When Spamassassin tags it as spam?

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Ralf Hildebrandt
* Brian brel.astersik100...@copperproductions.co.uk: In the year 2010 it is not unreasonable to expect the MTA that takes responsibility for accepting a message to make reasonable checks about the validity or content of that message. Postfix can do this either via the milter interface OR the

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Robert Schetterer
Am 09.03.2010 13:17, schrieb Ralf Hildebrandt: * Brian brel.astersik100...@copperproductions.co.uk: In the year 2010 it is not unreasonable to expect the MTA that takes responsibility for accepting a message to make reasonable checks about the validity or content of that message. Postfix

Re: [sa] Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Charles Gregory
On Tue, 9 Mar 2010, Brian wrote: I'm happy to stay on the Postfix 'merry-go-round' for an answer, or we can just agree Postfix can't easily do this and move on and stop flogging this dead horse :-) I use Mail Avenger for a front end SMTP Says it all - Charles

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Ralf Hildebrandt
* Brian brel.astersik100...@copperproductions.co.uk: So Ralf - author of 'The Postfix Book', can you please now tell me how to get Postfix to reject mail before it accepts it and gives a 250 - When Spamassassin tags it as spam? Well, I'm using amavisd-new for that, since I'm also scanning

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread David Morton
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Brian wrote: And the bit where I said 'not using amavis / policy deamon / milter' escaped you where? For someone that wrote a book you don't seem to read well ;-) I want you to shoot that target *pulls out gun* Without a gun *pulls out

Re: End of Thread [Was: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt]

2010-03-09 Thread Ned Slider
Brian wrote: On Tue, 2010-03-09 at 12:35 +0100, Kai Schaetzl wrote: Brian wrote on Tue, 09 Mar 2010 06:51:45 +: Yes, but that does not answer my question {and is once more Postfix biased} AFAIK Postfix is totally unable to reject mail at SMTP time that Spamassassin decides IS SPAM without

Re: End of Thread [Was: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt]

2010-03-09 Thread Brian
On Tue, 2010-03-09 at 12:16 +, Ned Slider wrote: Brian wrote: On Tue, 2010-03-09 at 12:35 +0100, Kai Schaetzl wrote: Brian wrote on Tue, 09 Mar 2010 06:51:45 +: Yes, but that does not answer my question {and is once more Postfix biased} AFAIK Postfix is totally unable to reject

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Brian
On Tue, 2010-03-09 at 12:35 +0100, Kai Schaetzl wrote: Brian wrote on Tue, 09 Mar 2010 06:51:45 +: Yes, but that does not answer my question {and is once more Postfix biased} AFAIK Postfix is totally unable to reject mail at SMTP time that Spamassassin decides IS SPAM without the aid

EOT (was: Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt)

2010-03-09 Thread Karsten Bräckelmann
On Tue, 2010-03-09 at 13:20 +, Brian wrote: Move it to Postfix lists Better idea, just drop it! Postfix lacks features and it's a fair statement. Brian, you just missed your opportunity to do what you propose. There are enough arse lickers here without going to the Temple of Weiste

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Brian
On Tue, 2010-03-09 at 13:17 +0100, Ralf Hildebrandt wrote: * Brian brel.astersik100...@copperproductions.co.uk: In the year 2010 it is not unreasonable to expect the MTA that takes responsibility for accepting a message to make reasonable checks about the validity or content of that

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Brian
On Tue, 2010-03-09 at 14:04 +0100, Yet Another Ninja wrote: to stay on the Postfix 'merry-go-round' for an answer, or we can just agree Postfix can't easily do this and move on and stop flogging this dead horse :-) good idea - Here, its totally off topic. Move it to Postfix lists

Re: End of Thread [Was: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt]

2010-03-09 Thread Kai Schaetzl
Brian wrote on Tue, 09 Mar 2010 12:53:31 +: End of thread Obvbiously not for you. Well. Thank you so much for educating us clueless people. Thank you and good night. Kai -- Get your web at Conactive Internet Services: http://www.conactive.com

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Brian
On Tue, 2010-03-09 at 13:38 +, Ned Slider wrote: Brian wrote: On Tue, 2010-03-09 at 14:04 +0100, Yet Another Ninja wrote: to stay on the Postfix 'merry-go-round' for an answer, or we can just agree Postfix can't easily do this and move on and stop flogging this dead horse :-) good

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Robert Brooks
Brian wrote: On Tue, 2010-03-09 at 13:17 +0100, Ralf Hildebrandt wrote: * Brian brel.astersik100...@copperproductions.co.uk: In the year 2010 it is not unreasonable to expect the MTA that takes responsibility for accepting a message to make reasonable checks about the validity or content of

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Henrik K
On Tue, Mar 09, 2010 at 08:22:41AM -0600, David Morton wrote: What exactly *DO* you want?? He's a well known troll here, yet for some reason people want to amuse him and fill out the list with pointless arguments. PLEASE ignore him, since noone has taken the job of unsubscribing him

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Ted Mittelstaedt
Kai Schaetzl wrote: Brian wrote on Tue, 09 Mar 2010 06:51:45 +: Yes, but that does not answer my question {and is once more Postfix biased} AFAIK Postfix is totally unable to reject mail at SMTP time that Spamassassin decides IS SPAM without the aid of a milter or policy deamon of some

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Noel Butler
On Tue, 2010-03-09 at 16:33 +0200, Henrik K wrote: On Tue, Mar 09, 2010 at 08:22:41AM -0600, David Morton wrote: What exactly *DO* you want?? He's a well known troll here, yet for some reason people want to amuse him and fill out the list with pointless arguments. PLEASE ignore

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Bob O'Brien
Noel Butler wrote: He has a point though, and why is it when people don't agree with someone the troll label comes out, FFS get over your selves. People always only half read, and then go half cocked, its called life, get used to it. In this case the troll label is more of an

Re: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-09 Thread Brian
On Tue, 2010-03-09 at 15:22 -0800, Bob O'Brien wrote: Noel Butler wrote: He has a point though, and why is it when people don't agree with someone the troll label comes out, FFS get over your selves. People always only half read, and then go half cocked, its called life, get used to

Fwd: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-08 Thread Michael Scheidell
just a heads up: I don't know if there is a problem with SA milter, but there is a snort signature for it now. Original Message Subject: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt Date: Mon, 8 Mar 2010 13:03:52 + From

Re: Fwd: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-08 Thread Ned Slider
Ned Slider wrote: Brian wrote: The key is this: If spamass-milter is run with the expand flag (-x option) it runs a popen() including the attacker supplied recipient (RCPT TO). POC IS $ nc localhost 25 220 ownthabox ESMTP Postfix (Ubuntu) mail from: me () me com 250 2.1.0 Ok rcpt to:

Re: Fwd: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-08 Thread Brian
: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt Date: Mon, 8 Mar 2010 13:03:52 + From: Kevin Ross kevros...@googlemail.com To:emerging-s...@emergingthreats.net emerging-s...@emergingthreats.net, Matt Jonkman jonk

Re: Fwd: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-08 Thread Brian
That's Postfix 2.3.3 on RHEL5 BTW :-) $ rpm -q postfix postfix-2.3.3-2.1.el5_2.x86_64 Tell me Ned, how do you get Postfix (2.3.3 on RHEL5) to reject at SMTP time without using a the milter or something hideous like Amavis-crashalot? Perhaps if they added some features to that old dinosaur

Re: Fwd: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-08 Thread Ned Slider
Subject: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt Date: Mon, 8 Mar 2010 13:03:52 + From: Kevin Ross kevros...@googlemail.com To: emerging-s...@emergingthreats.net emerging-s...@emergingthreats.net, Matt Jonkman jonk...@jonkmans.com alert

Re: Fwd: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-08 Thread Ned Slider
Brian wrote: That's Postfix 2.3.3 on RHEL5 BTW :-) $ rpm -q postfix postfix-2.3.3-2.1.el5_2.x86_64 Tell me Ned, how do you get Postfix (2.3.3 on RHEL5) to reject at SMTP time without using a the milter or something hideous like Amavis-crashalot? Perhaps if they added some features to that old

Re: Fwd: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-08 Thread Ned Slider
Ned Slider wrote: Brian wrote: That's Postfix 2.3.3 on RHEL5 BTW :-) $ rpm -q postfix postfix-2.3.3-2.1.el5_2.x86_64 Tell me Ned, how do you get Postfix (2.3.3 on RHEL5) to reject at SMTP time without using a the milter or something hideous like Amavis-crashalot? Perhaps if they added some

Re: Fwd: [Emerging-Sigs] SIG: SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt

2010-03-08 Thread Brian
On Mon, 2010-03-08 at 20:44 +, Ned Slider wrote: Brian wrote: That's Postfix 2.3.3 on RHEL5 BTW :-) $ rpm -q postfix postfix-2.3.3-2.1.el5_2.x86_64 Tell me Ned, how do you get Postfix (2.3.3 on RHEL5) to reject at SMTP time without using a the milter or something hideous like