I think I have identified a bug in the SMTP file extension filter of the SMTP proxy. It seems that if a message with a spoofed from address bounces at its destination the bounce will not be stopped from being returned to the spoofed sender even if it has an attachment with a rejected extension. I have not fully tested this but I would expect with the latest virus other people will likely be experiencing this. I do not have the virus scanning option so this may or may not have an impact on the results.
As a side note I would be curious to see if the bounces get virus scanned.
Take a look, I would be interested to see if others can replicate this problem.
Ted
Here are some sanitized headers from an actual message that made it through.
Return-Path:
Received: from gateway.astarodomain.com (gateway.astarodomain.com [192.168.10.1])
by mailserver.astarodomain.com (8.12.8/8.12.8) with ESMTP id i0SHogI3002743
for ; Wed, 28 Jan 2004 09:50:42 -0800
Received: from [209.151.96.18] (helo=mail3.bounceingdomain.net)
by gateway.astarodomain.com with smtp (Exim 4.22)
id 1Altpo-0002ss-TQ
for fred@astarodomain.com; Wed, 28 Jan 2004 09:50:40 -0800
Received: (qmail 16430 invoked for bounce); 28 Jan 2004 17:50:40 -0000
Date: 28 Jan 2004 17:50:40 -0000
From: MAILER-DAEMON@bounceingdomain.net
To: fred@astarodomain.com
Subject: failure notice
Message-Id:
X-Spam-Score: 3.7 (+++)
X-Spam-Report: 3.7/5.0
Spamassassin report follows
* 1.0 -- From: does not include a real name
* 1.2 -- BODY: Contains a large block of hexadecimal code
* 1.5 -- message body is 25-50% uppercase
X-Scan-Signature: 8a1ac8109de58d179375779ad2d13f5f
X-AntiVirus: scanned for viruses by AMaViS 0.2.1-pre3 (http://amavis.org/)
Hi. This is the qmail-send program at bounceingdomain.net.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.
:
Sorry, no mailbox here by that name. (#5.1.1)
--- Below this line is a copy of the message.
Return-Path:
Received: (qmail 16413 invoked from network); 28 Jan 2004 17:50:38 -0000
Received: from adsl-User.virusinfected.net (HELO astarodomain.com) (
10.15.182.101)
by mx3.bounceingdomain.net with SMTP; 28 Jan 2004 17:50:38 -0000
From: fred@astarodomain.com
To: jack@bounceingdomain.net
Subject: hello
Date: Wed, 28 Jan 2004 11:57:37 -0600
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0008_56B533C1.FA0D253B"
X-Priority: 3
X-MSMail-Priority: Normal
This is a multi-part message in MIME format.
------=_NextPart_000_0008_56B533C1.FA0D253B
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: 7bit
Mail transaction failed. Partial message is available.
------=_NextPart_000_0008_56B533C1.FA0D253B
Content-Type: application/octet-stream;
name="data.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="data.zip"
This thread was automatically locked due to age.