Until a few hours ago I was running mailman 2.1.29 on Debian Stretch, as
packaged by Debian, e.g. mailman_1:2.1.29-1_amd64.deb, so I was missing
the latest update published by Debian on April, 24 as
mailman_1:2.1.29-1+deb10u1_amd64.deb. That means my mailman was
vulnerable to this specific issue:
https://security-tracker.debian.org/tracker/CVE-2020-12137
which is a XSS issue, and, as such, it can hardly be the cause of my
problem. However I've now updated it nevertheless.
A few hours ago I received a FBL complaint notification about a monthly
subscription reminder marked as spam and actually coming from my server.
The subscription reminder was attached to the FBL complaint, so I could
see the mailman list subscribed email inside it, which is
[email protected]: it's clearly a fake email
address or a real email address that's been created just for sending spam.
The real user that raised the complaint is not shown for obvious privacy
reasons, though I could discover it from the message id, but who cares,
he's right after all, but by double checking the message id I could
confirm the whole reminder is authentic and it actually went out of my
mailserver. It is attached here, except I've masked my real domain name
and my real server ip address.
My mailman subscription logs (/var/log/mailman/subscribe*) go back one
year and that fake email address does not appear in any of them, nor it
is listed in the current subscribers list. It obviously does NOT match
the email address of the user that received the spammed reminder and
that raised the complaint.
How did it happen? Is there a security flaw in my mailman setup? Where
should I start looking at?
Source: Italia Online (Libero and Virgilio)=0D
Abuse-Type: complaint=0D
Subscription-Link: https://fbl.returnpath.net/manage/subscriptions/394805=
=0D
User-Agent: ReturnPathFBL/2.0=0D
Original-Rcpt-To: [email protected]=0D
Arrival-Date: Mon, 01 Jun 2020 03:00:04 +0000=0D
Original-Mail-From: [email protected]=0D
Reported-Domain: my.real.hostname.it=0D
Source-Ip: my.real.mailman.server.ip.address=0D
Feedback-Type: abuse=0D
Version: 1=0D
--2b38e7ed6655b3398b3fa78c503692fce35b2e77326c2691bbcfb3bc2516
Content-Type: message/rfc822
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Content-ID: <[email protected]>
Delivered-To: *****
Received: from mobimap.libero.it
by <local> with IMAP4 (i;15392:1)
Mon, 01 Jun 2020 03:00:27 +0000
Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: from dcd-18 ([10.103.10.26])
by dcbackend-44.iol.local with LMTP id aBB+HUtv1F5HTwMAm9QHFw
for <[email protected]>; Mon, 01 Jun 2020
05:00:27 +0200
Received: from dcp-12.iol.local ([10.103.10.26])
by dcd-18 with LMTP id 8KFpHUtv1F72MQAAWU+Phw
; Mon, 01 Jun 2020 05:00:27 +0200
Received: from libero.it ([10.103.10.26])
by dcp-12.iol.local with LMTP id oBQ9Dktv1F6y6wAAFc0f+g
; Mon, 01 Jun 2020 05:00:27 +0200
Received: from my.real.hostname.it ([my.real.mailman.server.ip.address])
by smtp-26.iol.local with ESMTP
id fagcjaRdEBNRlfagcj6sQm; Mon, 01 Jun 2020 05:00:27 +0200
X-IOL-DMARC: fail_monitor con il dominio my.real.domain.where.i.host.mailman
X-IOL-DKIM: Messaggio non firmato
X-IOL-SPF: pass con l'IP my.real.mailman.server.ip.address;my.real.hostname.it
X-IOL-SEC: _SPFOK_NODKIM_DMARCFAIL_ENVFROMHEADDIFF
X-IOL-Original-Envfrom: [email protected]
x-libjamoibt: 2601
Received-SPF: pass
X-CNFS-Analysis: v=2.3 cv=X7os11be c=1 sm=1 tr=0
a=FkFSD/Dudah5UTUvEddLDw==:117 a=FkFSD/Dudah5UTUvEddLDw==:17 a=lP7XrAztAAAA:8
a=KiCxJD0x+Pe5VASQKmYoJrcyuOo=:19 a=xqWC_Br6kY4A:10 a=8nJEP1OIZ-IA:10
a=nTHF0DUjJn0A:10 a=Mrz3sjv-sVQA:10 a=IAtt1hzdAAAA:8 a=vYhxhHx_zviUCDRhy94A:9
a=wPNLvfGTeEIA:10 a=2EkGEB5KO2G9k0KlfTuJ:22 a=1L9rwC9n54gXs6W524hS:22
Received: from my.real.hostname.it ([::1])
by my.real.hostname.it with ESMTP
id 0000000000123253.000000005ED46F3F.00004A46; Mon, 01 Jun 2020 05:00:15 +0200
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Subject: promemoria per gli iscritti della lista
my.real.domain.where.i.host.mailman
From: [email protected]
To: [email protected]
X-No-Archive: yes
Auto-Submitted: auto-generated
Message-ID: <[email protected]>
Date: Mon, 01 Jun 2020 05:00:04 +0200
Precedence: bulk
X-BeenThere: [email protected]
X-Mailman-Version: 2.1.29
List-Id: <mailman.my.real.hostname.it>
X-List-Administrivia: yes
Errors-To: [email protected]
Sender: "Mailman" <[email protected]>
X-CMAE-Envelope:
MS4wfE7WgNK6+1TCWJT2l9eUtLErptK18C5819kRL7yRE0HAlor0NJBLXLDL6HfOahF0FqVW6I95j5Oz78Y4MekgnFd5rnHMtNjcemup+IEvZPAik3ig8RbU
yUf5JnpXs0aKtyC4ykkZ73aCGK8h7SqTc+S8FR9HSkpVwEpBFRFMHW5PAagGRRIICd1fep7ihrf2iQ==
X-Mru-Rpop: 1
X-Ipop: 89664477
X-Mru-UID: 1089306654
X-Mailru-Intl-Transport: d,4f36b03
Questo promemoria, inviato con cadenza mensile, elenca le tue
iscrizioni alle liste gestite da my.real.domain.where.i.host.mailman, e
per ognuna di esse specifica le informazioni necessarie per cambiarla
o cancellarla.
Puoi visitare gli URL per cambiare il tuo stato d'iscrizione o la
configurazione, inclusa la cancellazione, il settaggio della modalit=E0
di spedizione digest, o disabilitare completamente la spedizione (es.,
per una vacanza), e cos=EC via.
In aggiunta all'interfaccia web, puoi usare anche l'email per fare
alcuni cambiamenti. Per altre informazioni, invia un messaggio
all'indirizzo '-request' della lista (per esempio,
[email protected]) contenente solamente
la parola 'help' nel corpo del messaggio. Ti sar=E0 inviato un
messaggio con le istruzioni.
Se hai domande, problemi, commenti, ecc., inviali a
[email protected]. Grazie!
Password per [email protected]: =
Lista Password // URL
---- -------- =
[email protected]
voanteod =
https://my.real.domain.where.i.host.mailman/options/my.real.list.name/ada3167eb87301cb4835917425f07242%40libero.it
--2b38e7ed6655b3398b3fa78c503692fce35b2e77326c2691bbcfb3bc2516--
------------------------------------------------------
Mailman-Users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3/lists/mailman-users.python.org/
Mailman FAQ: http://wiki.list.org/x/AgA3
Security Policy: http://wiki.list.org/x/QIA9
Searchable Archives: https://www.mail-archive.com/[email protected]/
https://mail.python.org/archives/list/[email protected]/
