Mail goes from the list to a subscriber at the af.mil address - and the
Exchange server does the obviously broken thing and tries to send it back to
the RFC822 cc: field, instead of doing what it's supposed to do and deliver it
to the RFC821 'RCPT TO:' (which it knows - see the first Received: header has
the 'for <destination>' in it, and sending bounces back to the RFC821 MAIL
FROM:
Obligatory Full-Disclosure tie-in: Here we have an obviously misconfigured
mail system inside the 'af.mil' domain. Three of the servers were even nice
enough to identify their exact patch levels (It appears that 2 of them are
still at .211 rather than .1830). How many different ways can you think of to
leverage the information in the Received: headers into a full-scale intrusion?
I already know why *I* know all this - anybody care to guess how? (The list
managers are ineligible for this one.. ;)
Received: from fsjubj14.exchange.gunter.af.mil (FSJUBJ14.exchange.gunter.af.mil
[143.158.200.214])
by lists.grok.org.uk (Postfix) with ESMTP id BE8847D4
for <full-disclosure@xxxxxxxxxxxxxxxxx>; Fri, 20 May 2005 18:55:39
+0100 (BST)
Received: from fsjubj12.exchange.gunter.af.mil ([143.158.200.212]) by
fsjubj14.exchange.gunter.af.mil with Microsoft SMTPSVC(6.0.3790.211);
Fri, 20 May 2005 12:55:38 -0500
Received: from mail pickup service by fsjubj12.exchange.gunter.af.mil with
Microsoft SMTPSVC;
Fri, 20 May 2005 12:55:29 -0500
Received: from fsjubj13.exchange.gunter.af.mil ([143.158.200.213]) by
fsjubj12.exchange.gunter.af.mil with Microsoft SMTPSVC(6.0.3790.211);
Fri, 20 May 2005 11:12:49 -0500
Received: from smtpgw1.gunter.afmc.ds.af.mil ([143.158.253.9]) by
fsjubj13.exchange.gunter.af.mil with Microsoft SMTPSVC(6.0.3790.1830);
Fri, 20 May 2005 11:12:48 -0500
Received: from lists.grok.org.uk ([195.184.125.51])
by smtpgw1.gunter.afmc.ds.af.mil (SAVSMTP 3.1.1.32) with SMTP id
M2005052011053121905
for <suzanne.vanpatten@xxxxxxxxxxxxx>; Fri, 20 May 2005 11:05:31 -0500
Attachment:
pgpekPEWqR2QU.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/