[35377] in bugtraq
Re: Is predictable spam filtering a vulnerability?
daemon@ATHENA.MIT.EDU (Jon Fiedler)
Sat Jun 19 16:40:42 2004
Message-ID: <40D38D99.8090903@cwru.edu>
Date: Fri, 18 Jun 2004 19:49:29 -0500
From: Jon Fiedler <jmf9@cwru.edu>
Reply-To: jmf9@cwru.edu
MIME-Version: 1.0
To: dfs@roaringpenguin.com
Cc: bugtraq@securityfocus.com
In-Reply-To: <Pine.LNX.4.58.0406170727510.5272@shishi.roaringpenguin.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
David F. Skoll wrote:
>On Wed, 16 Jun 2004, R Armiento wrote:
>
>
>
>>However, 'C':s spam filter silently drops the email.
>>
>>
>
>In my opinion, any spam filter that silently drops e-mail is broken, and
>is indeed a security risk. A spam filter MUST respond with a 500 SMTP
>failure code if it rejects a message.
>
>Regards,
>
>David.
>
>
This ignores client side spam filters, and doesn't really change the
attack. The 500 message would be sent back to A, but not B, so B is
still in the dark about C not receiving the emails.
jon
