[gentoo-security] .com attachment attack?

[Adrian CAPDEFIER]

Hi.
I seem to be the victim of an attack to get me of mailing lists.
Here is the message I've been getting with the contents of the
file ______-ed out.
So my server doesn't allow .com attachements and this attacker somehow 
manages to make the mailing list manager think messages sent to me are 
bouncing.
Am I right?

gentoo-security-help@l.g.o wrote:
> Hi! This is the ezmlm program. I'm managing the
> gentoo-security@g.o mailing list.
>
> I'm working for my owner, who can be reached
> at gentoo-security-owner@g.o.
>
>
> Messages to you from the gentoo-security mailing list seem to
> have been bouncing. I sent you a warning message, but it bounced.
> I've attached a copy of the bounce message.
>
> This is a probe to check whether your address is reachable. If this
> probe bounces, I will remove your address from the
> gentoo-security@g.o mailing list, without further notice.
>
> You can re-subscribe by sending a message to this address:
>    <gentoo-security-subscribe@g.o>
>
>
> --- Enclosed is a copy of the bounce message I received.
>
> Return-Path: <>
> Received: (qmail 22187 invoked from network); 2 Aug 2004 00:10:57 +0000
> Received: from horse.hostspectrum.com (209.120.224.103)
>   by lists.gentoo.org with AES256-SHA encrypted SMTP; 2 Aug 2004 00:10:57 +0000
> Received: from mailnull by horse.hostspectrum.com with local (Exim 4.34)
> 	id 1BrQPf-00072M-Nm
> 	for gentoo-security-return-warn-1091405444.lblaoilajclmcdganoam-adriancapdefier=digifin.ro@l.g.o; Sun, 01 Aug 2004 19:10:47 -0500
> X-Failed-Recipients: adriancapdefier@×××××××.ro
> Auto-Submitted: auto-generated
> From: Mail Delivery System <Mailer-Daemon@××××××××××××××××××.com>
> To: gentoo-security-return-warn-1091405444.lblaoilajclmcdganoam-adriancapdefier=digifin.ro@l.g.o
> Subject: Mail delivery failed: returning message to sender
> Message-Id: <E1BrQPf-00072M-Nm@××××××××××××××××××.com>
> Date: Sun, 01 Aug 2004 19:10:47 -0500
> X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
> X-AntiAbuse: Primary Hostname - horse.hostspectrum.com
> X-AntiAbuse: Original Domain - lists.gentoo.org
> X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
> X-AntiAbuse: Sender Address Domain -
> X-Source:
> X-Source-Args:
> X-Source-Dir:
>
> This message was created automatically by mail delivery software.
>
> A message that you sent could not be delivered to one or more of its
> recipients. This is a permanent error. The following address(es) failed:
>
>   adriancapdefier@×××××××.ro
>     This message has been rejected because it has
>     a potentially executable attachment "MP3.com"
>     This form of attachment has been used by
>     recent viruses or other malware.
>     If you meant to send this file then please
>     package it up as a zip file and resend it.
>
> ------ This is a copy of the message, including all the headers. ------
>
> Return-path: <gentoo-security-return-warn-1091405444.lblaoilajclmcdganoam-adriancapdefier=digifin.ro@l.g.o>
> Received: from [156.56.111.196] (helo=parrot.gentoo.org)
> 	by horse.hostspectrum.com with esmtp (TLSv1:AES256-SHA:256)
> 	(Exim 4.34)
> 	id 1BrQPf-00071b-EC
> 	for adriancapdefier@×××××××.ro; Sun, 01 Aug 2004 19:10:47 -0500
> Received: (qmail 1401 invoked by uid 89); 2 Aug 2004 00:10:53 +0000
> Mailing-List: contact gentoo-security-help@g.o; run by ezmlm
> Date: 2 Aug 2004 00:10:53 -0000
> Message-ID: <1091405453.10469.ezmlm-warn@l.g.o>
> From: gentoo-security-help@l.g.o
> To: adriancapdefier@×××××××.ro
> Content-type: text/plain; charset=us-ascii
> Subject: ezmlm warning
>
> Hi! This is the ezmlm program. I'm managing the
> gentoo-security@g.o mailing list.
>
> I'm working for my owner, who can be reached
> at gentoo-security-owner@g.o.
>
>
> Messages to you from the gentoo-security mailing list seem to
> have been bouncing. I've attached a copy of the first bounce
> message I received.
>
> If this message bounces too, I will send you a probe. If the probe bounces,
> I will remove your address from the gentoo-security mailing list,
> without further notice.
>
>
> I've kept a list of which messages from the gentoo-security mailing list have
> bounced from your address.
>
> Copies of these messages may be in the archive.
>
> To retrieve a set of messages 123-145 (a maximum of 100 per request),
> send an empty message to:
>    <gentoo-security-get.123_145@g.o>
>
> To receive a subject and author list for the last 100 or so messages,
> send an empty message to:
>    <gentoo-security-index@g.o>
>
> Here are the message numbers:
>
>    1221
>    1224
>
> --- Enclosed is a copy of the bounce message I received.
>
> Return-Path: <>
> Received: (qmail 14884 invoked from network); 21 Jul 2004 07:44:37 +0000
> Received: from horse.hostspectrum.com (209.120.224.103)
>   by lists.gentoo.org with AES256-SHA encrypted SMTP; 21 Jul 2004 07:44:37 +0000
> Received: from mailnull by horse.hostspectrum.com with local (Exim 4.34)
> 	id 1BnBm3-0004IT-0b
> 	for gentoo-security-return-1221-adriancapdefier=digifin.ro@l.g.o; Wed, 21 Jul 2004 02:44:23 -0500
> X-Failed-Recipients: adriancapdefier@×××××××.ro
> Auto-Submitted: auto-generated
> From: Mail Delivery System <Mailer-Daemon@××××××××××××××××××.com>
> To: gentoo-security-return-1221-adriancapdefier=digifin.ro@l.g.o
> Subject: Mail delivery failed: returning message to sender
> Message-Id: <E1BnBm3-0004IT-0b@××××××××××××××××××.com>
> Date: Wed, 21 Jul 2004 02:44:23 -0500
> X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
> X-AntiAbuse: Primary Hostname - horse.hostspectrum.com
> X-AntiAbuse: Original Domain - lists.gentoo.org
> X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
> X-AntiAbuse: Sender Address Domain -
> X-Source:
> X-Source-Args:
> X-Source-Dir:
>
> This message was created automatically by mail delivery software.
>
> A message that you sent could not be delivered to one or more of its
> recipients. This is a permanent error. The following address(es) failed:
>
>   adriancapdefier@×××××××.ro
>     This message has been rejected because it has
>     a potentially executable attachment "MP3.com"
>     This form of attachment has been used by
>     recent viruses or other malware.
>     If you meant to send this file then please
>     package it up as a zip file and resend it.
>
> ------ This is a copy of the message, including all the headers. ------
>
> Return-path: <gentoo-security-return-1221-adriancapdefier=digifin.ro@l.g.o>
> Received: from [156.56.111.196] (helo=parrot.gentoo.org)
> 	by horse.hostspectrum.com with esmtp (TLSv1:AES256-SHA:256)
> 	(Exim 4.34)
> 	id 1BnBm2-0004IJ-JR
> 	for adriancapdefier@×××××××.ro; Wed, 21 Jul 2004 02:44:22 -0500
> Received: (qmail 3276 invoked by uid 89); 21 Jul 2004 07:43:50 +0000
> Mailing-List: contact gentoo-security-help@g.o; run by ezmlm
> Precedence: bulk
> List-Post: <mailto:gentoo-security@g.o>
> List-Help: <mailto:gentoo-security-help@g.o>
> List-Unsubscribe: <mailto:gentoo-security-unsubscribe@g.o>
> List-Subscribe: <mailto:gentoo-security-subscribe@g.o>
> List-Id: Gentoo Linux mail <gentoo-security.gentoo.org>
> X-BeenThere: gentoo-security@g.o
> Delivered-To: mailing list gentoo-security@l.g.o
> Received: (qmail 13423 invoked from network); 21 Jul 2004 07:43:43 +0000
> Date: Wed, 21 Jul 2004 09:40:45 +0100
> To: "Gentoo-security" <gentoo-security@l.g.o>
> From: "Gentoo" <gentoo@×××××××××××.org>
> Message-ID: <tnsnraezeeqrruituys@l.g.o>
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
>         boundary="--------kkwrockmnbyvvzoqzwtn"
> Subject: [gentoo-security] Re:
>
> ----------kkwrockmnbyvvzoqzwtn
> Content-Type: text/html; charset="us-ascii"
> Content-Transfer-Encoding: 7bit
>
> <html><body>
>
>>Predators<br><br>
>
>
> <br>
> </body></html>
>
> ----------kkwrockmnbyvvzoqzwtn
> Content-Type: application/octet-stream; name="MP3._c_o_m_"
> Content-Transfer-Encoding: base64
> Content-Disposition: attachment; filename="MP3._c_o_m_"
>
> TVoAAAEAAAACAAAA//8AAEAAAAAAAAAAQAAAAAAAAAC0TM0hAAAAAAAAAAAAAAAAAAAAAAAA
__________________________________________________________________________
> IrskcHZRkMCJnKCDZQEvHlKDnCwSTzI/KiFjw6SBbUIvg4LGDA==
>
>
> ----------kkwrockmnbyvvzoqzwtn
> Content-Type: text/plain; charset=us-ascii
>
> --
> gentoo-security@g.o mailing list
> ----------kkwrockmnbyvvzoqzwtn--
>
>
>
>


-- 

Adi

--
gentoo-security@g.o mailing list