[95571] in RedHat Linux List
Re:Mail - denial of service
daemon@ATHENA.MIT.EDU (rex)
Mon Oct 19 13:01:59 1998
Reply-To: "rex" <rex.henderson@santafe.cc.fl.us>
From: "rex" <rex.henderson@santafe.cc.fl.us>
To: <redhat-list@redhat.com>
Date: Mon, 19 Oct 1998 13:01:12 -0400
Resent-From: redhat-list@redhat.com
This is a multi-part message in MIME format.
------=_NextPart_000_004C_01BDFB60.8C7916A0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Actually, this seems to be a very old known way to deny someone mail.
Here is an excerpt I gathered from a hacker resource dated 1990
...
You can annoy users other ways. One thing you can do is screw up =
the user's mailbox.
The way to do this is to find a binary file (30k or bigger) on the =
system
which YOU have access to read. then, do this:
$ cat binary_file | mail loozer
or
$ mail loozer < binary file
That usually will spilt into 2 messages or more. The 1st message =
will
have a from line.. (from you ..), but the second WILL NOT! Since it =
does
not, the mail reader will keep exiting and giving him an error =
message until
it gets fixed.. The way to fix it is to go to the mail box that got =
hit
with this trick (usually only the one who got hit (or root) and do =
this),
and edit the file, and add a from line.. like
From username..
...
Idle hands are the devil's own!
Rex
Date: Thu, 15 Oct 1998 11:10:07 -0700
From: "Fred Lenk" <fllnx@commpower.com>
To: redhat-list@redhat.com
Subject: Re: "Sendmail Problem"
Message-Id: <199810151808.LAA25275@commpower.com>
Content-type: text/plain; charset=3DUS-ASCII
Content-transfer-encoding: 7BIT
We used to have an employee who received email from a list.=20
One of the list participants used a mail server which=20
incorrectly used "rom:" instead of "From:" on the "from"=20
line of the header. Eventually, this message worked its way=20
up to the beginning of the file. So while the file had=20
size, the user couldn't retrieve any email - Until I=20
manually went in and corrected the "rom:" to "From:".
I thought that was an interesting accidental "loss of=20
service attack" i hadn't seen before.
> Date: Thu, 15 Oct 1998 09:43:26 +0200
> From: "Anthony E. Greene" <agreene@pobox.com>
> To: redhat-list@redhat.com
> Subject: Re: "Sendmail Problem"
> At 13:05 1998-10-15 +0530, Vineeta wrote:
> > I have been coming across this problem a bit too frequently:
> >My /var/spool/mail/username shows mail for me but when i try to =
download the
> >mails ,it says "no new messages on the server".
>=20
> That's because the messages have been marked read by the POP3 server.
> Depending on your mail client software, you may be able to force it to
> download previously read messages.
>=20
> Tony
> --
> Anthony E. Greene <agreene@pobox.com>
> Homepage and PGP Key: <http://www.pobox.com/~agreene/>
>=20
>=20
Fred Lenk, SysAdmin, CommPower
mailto:fllnx@commpower.com
http://www.commpower.com - Check jobs posting.
HPVer: http://www.lenk.net/tbolt.htm
------=_NextPart_000_004C_01BDFB60.8C7916A0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD W3 HTML//EN">
<HTML>
<HEAD>
<META content=3Dtext/html;charset=3Diso-8859-1 =
http-equiv=3DContent-Type>
<META content=3D'"MSHTML 4.72.2106.6"' name=3DGENERATOR>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT color=3D#000000 size=3D2>Actually, this seems to be a very =
old known way=20
to deny someone mail.</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT><FONT size=3D2>Here is an =
excerpt I=20
gathered from a hacker resource dated 1990</FONT></DIV>
<DIV><FONT size=3D2></FONT> </DIV>
<DIV><FONT size=3D2>...<BR> You can annoy users other=20
ways. One thing you can do is screw up the user's=20
mailbox.<BR> The way to do this is to find a binary =
file (30k=20
or bigger) on the system<BR> which YOU have access to=20
read. then, do this:</FONT></DIV>
<DIV><FONT size=3D2> $ cat binary_file | mail=20
loozer</FONT></DIV>
<DIV><FONT size=3D2> or<BR> $ mail =
loozer <=20
binary file<BR> That usually will spilt into 2 =
messages or=20
more. The 1st message will<BR> have a from =
line.. (from=20
you ..), but the second WILL NOT! Since it =
does<BR> not,=20
the mail reader will keep exiting and giving him an error message=20
until<BR> it gets fixed.. The way to fix it is =
to go to=20
the mail box that got hit<BR> with this trick (usually =
only=20
the one who got hit (or root) and do this),<BR> and =
edit the=20
file, and add a from line.. like</FONT></DIV>
<DIV><FONT size=3D2> From username..</FONT></DIV>
<DIV><FONT size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>...</FONT></DIV>
<DIV><FONT size=3D2>Idle hands are the devil's own!</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2>Rex</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV><FONT color=3D#000000 size=3D2>Date: Thu, 15 Oct 1998 11:10:07 =
-0700<BR>From:=20
"Fred Lenk" <<A=20
href=3D"mailto:fllnx@commpower.com">fllnx@commpower.com</A>><BR>To: =
<A=20
href=3D"mailto:redhat-list@redhat.com">redhat-list@redhat.com</A><BR>Subj=
ect: Re:=20
"Sendmail Problem"<BR>Message-Id: <<A=20
href=3D"mailto:199810151808.LAA25275@commpower.com">199810151808.LAA25275=
@commpower.com</A>><BR>Content-type:=20
text/plain; charset=3DUS-ASCII<BR>Content-transfer-encoding: =
7BIT</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>We used to have an employee who =
received email=20
from a list. <BR>One of the list participants used a mail server which=20
<BR>incorrectly used "rom:" instead of "From:" on =
the=20
"from" <BR>line of the header. Eventually, this message worked =
its way=20
<BR>up to the beginning of the file. So while the file had <BR>size, the =
user=20
couldn't retrieve any email - Until I <BR>manually went in and corrected =
the=20
"rom:" to "From:".<BR>I thought that was an =
interesting=20
accidental "loss of <BR>service attack" i hadn't seen=20
before.</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>>=20
Date: Thu, 15 Oct =
1998=20
09:43:26 +0200<BR>>=20
From: =
"Anthony E.=20
Greene" <<A=20
href=3D"mailto:agreene@pobox.com">agreene@pobox.com</A>><BR>>=20
To: <A =
href=3D"mailto:redhat-list@redhat.com">redhat-list@redhat.com</A><BR>>=
=20
Subject: Re: "Sendmail=20
Problem"</FONT></DIV>
<DIV><FONT color=3D#000000 size=3D2></FONT> </DIV>
<DIV><FONT color=3D#000000 size=3D2>> At 13:05 1998-10-15 +0530, =
Vineeta=20
wrote:<BR>> > I have been coming across this problem a bit =
too=20
frequently:<BR>> >My /var/spool/mail/username shows mail for me =
but when i=20
try to download the<BR>> >mails ,it says "no new messages on =
the=20
server".<BR>> <BR>> That's because the messages have been =
marked read=20
by the POP3 server.<BR>> Depending on your mail client software, you =
may be=20
able to force it to<BR>> download previously read messages.<BR>>=20
<BR>> Tony<BR>> --<BR>> Anthony E. Greene =
<<A=20
href=3D"mailto:agreene@pobox.com">agreene@pobox.com</A>><BR>> =
Homepage=20
and PGP Key: <<A=20
href=3D"http://www.pobox.com/~agreene/">http://www.pobox.com/~agreene/</A=
>><BR>>=20
<BR>> <BR>Fred Lenk, SysAdmin, CommPower<BR><A=20
href=3D"mailto:fllnx@commpower.com">mailto:fllnx@commpower.com</A><BR><A =
href=3D"http://www.commpower.com">http://www.commpower.com</A> - Check =
jobs=20
posting.<BR>HPVer: <A=20
href=3D"http://www.lenk.net/tbolt">http://www.lenk.net/tbolt</A>.htm</FON=
T></DIV></BODY></HTML>
------=_NextPart_000_004C_01BDFB60.8C7916A0--
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
http://www.redhat.com http://archive.redhat.com
To unsubscribe: mail redhat-list-request@redhat.com with
"unsubscribe" as the Subject.
