Bug 54188 - sendmail allows external mail with from address xxx
Summary: sendmail allows external mail with from address xxx@localhost.localdomain
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: sendmail
Version: 7.1
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Florian La Roche
QA Contact: David Lawrence
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2001-10-01 12:16 UTC by Russell King
Modified: 2008-12-11 18:14 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2001-10-01 12:16:28 UTC
Embargoed:


Attachments (Terms of Use)

Description Russell King 2001-10-01 12:16:23 UTC
From Bugzilla Helper:
User-Agent: Mozilla/4.77 [en] (X11; U; Linux 2.2.19-6.2.7 i586)

Description of problem:
When an external SMTP session is established, and an address of
"xxx" is specified on the MAIL FROM: line, sendmail
blindly accepts this as valid.  Note that "xxx@localhost" is rejected by
sendmail.

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. from a remote host, telnet host 25
2. EHLO foobar.redhat.com
3. MAIL FROM: <xxx>
	

Actual Results:  220 caramon.arm.linux.org.uk ESMTP Sendmail 8.11.2/8.11.2;
Mon, 1 Oct 2001 13:12:09 +0100
EHLO raistlin.arm.linux.org.uk
250-caramon.arm.linux.org.uk Hello IDENT:rmk.linux.org.uk
[192.168.0.4], pleased to meet you
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE
250-DSN
250-ONEX
250-ETRN
250-XUSR
250-AUTH CRAM-MD5
250 HELP
MAIL FROM: <rmk@localhost>
501 5.5.4 <rmk@localhost>... Real domain name required for sender address
MAIL FROM: <rmk>
501 5.5.4 <rmk>... Sender ok


Expected Results:  220 caramon.arm.linux.org.uk ESMTP Sendmail
8.11.2/8.11.2; Mon, 1 Oct 2001 13:12:09 +0100
EHLO raistlin.arm.linux.org.uk
250-caramon.arm.linux.org.uk Hello IDENT:rmk.linux.org.uk
[192.168.0.4], pleased to meet you
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE
250-DSN
250-ONEX
250-ETRN
250-XUSR
250-AUTH CRAM-MD5
250 HELP
MAIL FROM: <rmk@localhost>
501 5.5.4 <rmk@localhost>... Real domain name required for sender address
MAIL FROM: <rmk>
501 5.5.4 <rmk>... Real domain name required for
sender address


Additional info:

In /etc/sendmail.cf, checks are made for various "localhost" addresses. 
"localhost.localdomain" is missing:

# handle case of @localhost on address
R<@> < $* @ localhost > $: < ? $&{client_name} > < $1 @ localhost >

The following line wants adding to this:
R<@> < $* @ localhost.localdomain >     $: < ? $&{client_name} > < $1 @
localhost.localdomain >

Note that localhost.localdomain still remains valid for local use, but not
for remote SMTP use.

Comment 1 Florian La Roche 2002-04-08 10:55:24 UTC
Fixed in 8.11.6-15 or newer.

Thanks,

Florian La Roche



Note You need to log in before you can comment on or make changes to this bug.