I've just been playing around with majordomo to add gobal password
featur to approve and noticed a potential security loophole with
the which command.
Namely, if the setting for which_access is less strict than
who_access, a user who meets the criteria for doing which
but not for doing who may be able to get a list of subscribers
by doing:
which .
which obviously returns a list of all subscribers to all lists
that the sender meets which_access criteria (subject to the limit
imposed by max_which_hits).
This is also a great way to build of a list of email addresses
from spamming!
BASIC RULE OF THUMB:
****** ENSURE which_access is AT LEAST AS STRICT as who_access ******
Nick
--
Nick Perry | AboarD Boats & Yachts Market Ltd
Webmaster Manager | 7a Fernshaw Road, LONDON, SW10 0TB. UK
Mobile: +44 (0)973 566204 | Tel: +44 (0)171 460 0030 Fax: 0040
| http://www.aboard.co.uk
Follow-Ups:
|
|
