nms-cgi-devel

[Nms-cgi-devel] Formmail insecurities

[Jeremy H. <jh_...@fa...>]

I don't know if you folks have seen this advisory:
  http://www.monkeys.com/anti-spam/formmail-advisory.pdf

I've contacted the author and he claims that many of the listed
vunerabilities are also present in the current NMS version of this script. I
checked whether he had informed you and he told me that he hasn't, and that
he doesn't plan to. I don't have any more details--I just figured I'd pass
on this info...

RE: [Nms-cgi-devel] Formmail insecurities

[Paul R. <pa...@ro...>]

I'd be interested in taking a stab at fixing the insecurities noted in this
advisory -- this is certainly an area where doing a better job can have a
tremendous impact.

Objections?

-paul


-----Original Message-----
From: nms...@li...
[mailto:nms...@li...]On Behalf Of Jeremy
Howard
Sent: Saturday, January 26, 2002 10:23 PM
To: nms...@li...
Subject: [Nms-cgi-devel] Formmail insecurities


I don't know if you folks have seen this advisory:
  http://www.monkeys.com/anti-spam/formmail-advisory.pdf

I've contacted the author and he claims that many of the listed
vunerabilities are also present in the current NMS version of this script. I
checked whether he had informed you and he told me that he hasn't, and that
he doesn't plan to. I don't have any more details--I just figured I'd pass
on this info...



_______________________________________________
Nms-cgi-devel mailing list
Nms...@li...
https://lists.sourceforge.net/lists/listinfo/nms-cgi-devel

Re: [Nms-cgi-devel] Formmail insecurities

[Dave C. <da...@da...>]

On Tue, Jan 29, 2002 at 12:59:52PM -0500, Paul Roub (pa...@ro...) wrote:
> I'd be interested in taking a stab at fixing the insecurities noted in this
> advisory -- this is certainly an area where doing a better job can have a
> tremendous impact.
> 
> Objections?

None from me.

Dave...

-- 

  "Don't you boys know any _nice_ songs?"

RE: [Nms-cgi-devel] Formmail insecurities

[Jonathan S. <gel...@ge...>]

On Tue, 29 Jan 2002, Paul Roub wrote:

> I'd be interested in taking a stab at fixing the insecurities noted in this
> advisory -- this is certainly an area where doing a better job can have a
> tremendous impact.
>

I fixed two of them in :

uid=68026(gellyfish) gid=100(users)
groups=100(users),7054(xmlxslt),40625(nms-cgi)
formmail FormMail.pl,1.26,1.27
Sun Jan 27 05:59:08 PST 2002
Update of /cvsroot/nms-cgi/formmail
In directory usw-pr-cvs1:/tmp/cvs-serv14246

Modified Files:
        FormMail.pl
Log Message:
Issues from  http://www.monkeys.com/anti-spam/formmail-advisory.pdf
* Left anchored regex to check referer
* If $secure and no referer supplied then croak


/J\
-- 
Jonathan Stowe                      |
<http://www.gellyfish.com>          |      This space for rent
                                    |

Re: [Nms-cgi-devel] Formmail insecurities

[Dave C. <da...@da...>]

On Sun, Jan 27, 2002 at 02:22:39PM +1100, Jeremy Howard (jh_...@fa...) wrote:
> I don't know if you folks have seen this advisory:
>   http://www.monkeys.com/anti-spam/formmail-advisory.pdf
> 
> I've contacted the author and he claims that many of the listed
> vunerabilities are also present in the current NMS version of this script. I
> checked whether he had informed you and he told me that he hasn't, and that
> he doesn't plan to. I don't have any more details--I just figured I'd pass
> on this info...

This chap's site came up on the london.pm list earlier today which
galvanised me into contacting the author.

He seems to think that because he looked at nms Formmail a few weeks ago
he's not going to bother again. He seems to have the idea that we don't 
don'r really know what we're doing because we haven't fixed all of 
Formmail's insecurities.

One interesting thing tho' - he's now released his own version of Formmail
that patches _all_ of the insecurities (or so he claims). 

It's available from <ftp://ftp.monkeys.com/pub/formmail/1.9s/>. Might be
interesting if someone was to take a look.

He's got a more general rant about Formmail up at

<http://www.monkeys.com/anti-spam/filtering/formmail.html>

Dave...

-- 

  .sig missing...