Re: [Full-Disclosure] dupes

["Matthew Murphy" <mattmurphy@kc.rr.com>]

"Mark Bassett" writes:
>Anyone else getting message dupes?  The same messages keep coming to me,
and half the time I get the re: to the questions >before I get the post
>With the question.  wtf?   Am I the only one?

I believe this was described in a previous "Administrivia" posting entitled
"Duplicate Messages"(?) or something similar.  According to Len's
description, the problem is that posters CC multiple lists, as is typically
done with advisories.  Readers of lists like VulnWatch receive the message
with all of its "To" entries intact.  Some Microsoft SMTP servers that list
subscribers are using are incorrectly configured or buggy somewhere, and
send the messages out to every listed address.  So, when the larger,
moderated lists deliver messages to subscribers that were also posted here,
we get a second copy, or third, fourth, etc.

On another note, wouldn't this represent a security issue for these servers?
After all, they are allowing content originating from internet mail servers
(SecurityFocus, VulnWatch, etc.), and sending it to all addresses in the To:
field (including external ones), if any address in it is a valid local.  It
would also be worth investigating if these servers are vulnerable to
conventional relaying, and maybe blocking/delaying posts from them for the
time being.  At the very least, this is annoying, but it also provides an
avenue for spam relays, and when combined with an open proxy (or several if
you're paranoid), an effective, anonymous, channel to exploit buffer
overflows and other bugs in the MTAs of other domains (ala sendmail,
postfix).

Any comments, corrections, etc are welcome and encouraged.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html