Re: multiple lists commands attack --> majordomo vulnerabity?

[relph @ mando . engr . sgi . com (John Relph)]

On Oct 31, 12:42, Jason L Tibbitts III wrote:
>>>>>> "MH" == Marko Hotti <mhotti@lists.oulu.fi> writes:
>
>MH> The other mailing list server I'm running and administering at the
>MH> moment was attacked by some idiot who had sent about 50 subsequent
>MH> messages to the majordomo address - each message containing +100 lines
>MH> of the majordomo command 'lists'.
>
>For some reason I neglected to notice that there were multiple commands in
>a single message.  John L. already posted a solution that works for 1.9x; I
>can't do something quite that naive for 2.0 because doing a full list
>reconfiguration might take a huge number of commands.
>
>I suppose a per-transaction limit should be imposed by the core and should
>limit unapproved commands.  I'll have to think about it some more.

Is there any reason why duplicate commands could not be ignored?

For example:

	lists
	lists
	newconfig
	info
	intro
	intro
	lists

The second lists command could be ignored and the second intro command
could be ignored.

	-- John