sending a virus through form mail to attack and spam via sendmail?

[spewn]

I have been notified by my hosting company that my accounts are spamming thousands of emails, and the culprit is a file that ends in .jv...i have no files with such extension.

i was reading on the internet and saw something that eluded to hackers being able to upload a malicious file using form mail, or a message box, and once submitted, it attacks and grabs hold replicating itself and sending emails via sendmail on unix.

anyone heard of this, and anyone have a known cure, fix or way to not allow this?

thanks.

- g

 

[KevinADC]

Normally your local email client is infected and no the http server or the mail server. But I guess it would be possible.

------------------------------------------
- Kevin, perl coder unexceptional!

 

[travs69]

Check any scripts you have written to make sure they are easy to take advantage of for things like that. If you allow uploads only allow certain extensions (.jpg,.gif,.png etc) and if you have pages that email check and make sure that they aren't easily hackable.

So many people use a generic script to send email that almost anyone could force it to do what you want. The most common one I see is a html page where all of the data is passed to a "dumb" perl script (It takes variable for everything and just does what the variables tell it to). The problem is the html page contains everything the perl script should probably have hard coded into it (where to send email, with what subject, who to make it from, what to put in the body) and so on. So if you find that (and the the .cgi file is usually the same name everywhere) you can just say

http://www.somesites.com/cgi-bin/fo...rom=trustme@yaho.com&subject=PenisEnlargement

and so on.. these type of tools should be avoided. If you want your site to send you email then hard code in the To address in the .pl/.cgi file so no one can take advantage of it.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Travis - Those Who Say It Cannot Be Done Are Usually Interrupted by Someone Else Doing It; Give the wrong symptoms, get the wrong solutions;