FormMail could be used to flood servers with anonymous email
| formmail-anonymous-flooding (6242) |  Low Risk |
Description:
Matt Wright's FormMail CGI program could allow an attacker to send anonymous email to arbitrary recipients. FormMail fails to properly indicate the IP address of the sender. A remote attacker could exploit this vulnerability by sending anonymous emails to flood the servers of arbitrary recipients.
Platforms Affected:
- Matt's Script Archive, FormMail 1.0 to 1.6
Remedy:
Apply the FormMail.Pl script for this vulnerability, available from the Mailvalley Web site. See References.
Consequences:
References:
- BugTraq Mailing List, Mar 11 2001 - 22:06:37 CST, Re: CORRECTION to CODE: FormMail.pl can be used to send anonymous email at http://archives.neohapsis.com/archives/bugtraq/2001-03/0123.html.
- BugTraq Mailing List, Mon Jun 25 2001 - 10:24:10 CDT, Formmail.pl Exploit - Anti-Spam and security fix available at http://archives.neohapsis.com/archives/bugtraq/2001-06/0349.html.
- BugTraq Mailing List, Mon Mar 12 2001 - 04:23:17 CST, Re: CORRECTION to CODE: FormMail.pl can be used to send anonymous email at http://archives.neohapsis.com/archives/bugtraq/2001-03/0132.html.
- BugTraq Mailing List, Mon Mar 12 2001 - 04:43:02 CST, Re: CORRECTION to CODE: FormMail.pl can be used to send anonymous email at http://archives.neohapsis.com/archives/bugtraq/2001-03/0135.html.
- BugTraq Mailing List, Sat Mar 10 2001 - 11:43:43 CST, CORRECTION to CODE: FormMail.pl can be used to send anonymous email at http://archives.neohapsis.com/archives/bugtraq/2001-03/0108.html.
- BugTraq Mailing List, Sun Mar 11 2001 - 15:36:32 CST, Re: CORRECTION to CODE: FormMail.pl can be used to send anonymous email at http://archives.neohapsis.com/archives/bugtraq/2001-03/0122.html.
- BugTraq Mailing List, Wed May 10 2000 - 18:11:23 CDT, Black Watch Labs Vulnerability Alert at http://archives.neohapsis.com/archives/bugtraq/2000-05/0125.html.
- Mailvalley Web site, Anti-spam & Security fix for FormMail.pl script at http://www.mailvalley.com/formmail/.
- BID-2469: FormMail Recipient CGI Variable Spamming Vulnerability
- CVE-2001-0357: FormMail.pl in FormMail 1.6 and earlier allows a remote attacker to send anonymous email (spam) by modifying the recipient and message parameters.
Reported:
Mar 10, 2001
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net