This is not a security hole in majordomo. In the scenario you are
describing, majordomo is being completely bypassed and has nothing
to do with the distribution or delivery of the message. There is
not a "majordomo" patch that will help you.
There is a way to block or prevent an address from reaching the
/etc/aliases file at the MTA (sendmail) level with virtusertable
magic.
1. Make sure sendmail "trusts" majordomo.
2. Use an alias other than -outgoing or -list for your :include:
3. Use arguments to wrapper in an "@file" or via the <list>.config
4. Block access to your distribution alias via virtusertable
All these settings can be found in the majordomo-users archive.
Dan Liston
MajorDomo Administrator, MSER:EX wrote:
> We noticed a bad security hole with our majordomo lists. It was brought to
> our attention by the list subscribers who were getting spoofed virus
> rejections. The rejections were going to the listname-outgoing address and
> therefore bypassing the requirement for moderation.
>
> Has anyone else had this problem and how did they patch it?
>
> a template of aliases file config
>
> owner-l_tk_testlist: l_tk_testlist-owner
> l_tk_testlist: "|/home/majordomo/wrapper resend -l l_tk_testlist -h
> listsserver.ca -f l_tk_testlist-owner l_tk_testlist-outgoing"
> l_tk_testlist-owner: me@myaddress
> l_tk_testlist-approval: l_tk_testlist-owner
> owner-l_tk_testlist-approval: l_tk_testlist-owner
> l_tk_testlist-outgoing: :include:/home/majordomo/lists/l_tk_testlist
> owner-l_tk_testlist-outgoing: l_tk_testlist-owner
>
> Thanks,
> Majordomo Support
> mailto:Majordomo.Admin@gems1.gov.bc.ca
Follow-Ups:
References:
-
security hole
From: "MajorDomo Administrator, MSER:EX" <Majordomo.Admin@gems1.gov.bc.ca>
|
|
