Subject: Disabling EXPN and VRFY and smap, how

From: [email-masked]
Date: Thu, 20 Apr 2000 15:42:40 +0200

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello FWTK users,

There is a nice tool on
http://jenny.tti.co.jp/cgi-bin/checkmail/nph-expntest.cgi
which checks vor EXPN and VRFY vulnerability. Our (and not only our) FWTK
2.1 smap seems to be vulnerable.
This is clearly not, what
                                                                  
 rfc2505: anti-spam recommendations meen.                         

How can we fix this ?

btw. we are using the sabernet anti-spam-patches with MAPS-RBL checking for
smap

Mit freundlichem Gruss / Best Regards
-------------------------------------------------------------------------
- Dr. Thomas Hildenbrandt -
Netzstation Informationstechnik GmbH
Panoramastr. 17; 74417 Gschwend
Tel: +49 7972 936770 Fax: +49 7972 936790
e-mail: [email-masked]

---

From: [email-masked]
Date: Thu, 20 Apr 2000 19:51:32 +0400

nuqneH,

Don't believe security scanner programs, period.

> btw. we are using the sabernet anti-spam-patches with MAPS-RBL checking for

                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

From: Joseph S D Yao <[email-masked]>
Date: Thu, 20 Apr 2000 11:56:24 -0400

> btw. we are using the sabernet anti-spam-patches with MAPS-RBL checking for

I have no idea how those patches affect things.  But there should be NO
e-mail accounts on the machine on which 'smap' runs; therefore, there
should be no meaningful responses to EXPN and VRFY.  All true e-mail
accounts should be on your real e-mail server, buried deep within your
private network.

In fact, the original comments in smap 2.1 include:

 *	Unimplemented commands now return appropriate message instead
 *	on an incorrect answer - particularly EXPN and VRFY no longer
 *	return "User unknown".

and my comments in my compilation of patches include:

**	never used, this is a no-op.]  VRFY and EXPN have been changed
**	in 2.1 to echo any argument.  The rest, except for EHLO, just
**	respond in some random way.
**
**	jsdy CRITIQUE: I don't like the change in VRFY and EXPN,
**	because it doesn't "say what you mean", and because it may
**	encourage cracker kiddies to keep boring in; but it's now 2.1
**	"standard behavior."

In other words, if you say "vrfy santaclaus" it will say "santaclaus",
no matter whether or not there is such an account.  This probably
APPEARS vulnerable to the test you mention above, while not really
being so.

If you don't like this, there is an 'if ... else ...' clause which
sometimes says "User unknown" but usually echoes the input.  Take out
the "if", "else", and echo of the input.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: "Ken Long" <[email-masked]>
Date: Thu, 20 Apr 2000 10:21:46 -0600

I discussed this apparent vulnerability with our resident FWTK expert and his 
exact words were:

"smap only pretends to answer those requests.  No security 
information is actually compromised."

I feel safer.

Ken

On 20 Apr 00, at 15:42, [email-masked] wrote:

> which checks vor EXPN and VRFY vulnerability. Our (and not only our) FWTK 2.1
> smap seems to be vulnerable.