Subject: smap exploit by ORBS

From: "Ken Long" <[email-masked]>
Date: Wed, 21 Jun 2000 15:41:31 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

I've received the dreaded "xxx.xxx.xxx.xxx has been detected as an insecure 
email relay and added to the ORBS database" message from ORBS.  The specific 
exploit they found was in the form of:  

X-Envelope-Recipient: <[email-masked]  

where us.company.com is our real email server.  

My first question is this, will the Yao spam patches close this hole?  My 
second question is rather embarrassing.  Our regular C guy is out for awhile 
and I need to apply the Yao smap patches to the stock version 2.1 of smap.c 
but I don't know how.  Would someone please point me to the details?

TIA,
Ken Long

---

From: Keith Young <[email-masked]>
Date: Wed, 21 Jun 2000 18:29:27 -0400

Ken Long wrote:
> 
>  Our regular C guy is out for awhile

Actually, Joe Yao also wrote a beginner's tutorial on how to install
patches for the FWTK. You can find it here:
	http://www.fwtk.org/fwtk/docs/documentation.html#3.3

-- 
--Keith Young
-Director of Customer Care/Support, V-ONE Corp.
[email-masked]

---

From: "Ken Long" <[email-masked]>
Date: Mon, 26 Jun 2000 07:50:28 -0600

The stock 2.1 smap with the Yao patches did the trick here.  Orbs re-scanned 
me last Friday and all of their attempts to bounce email off my server were 
rejected.

Ken Long