Bugtraq: Re: procmail

[guenther () GAC EDU (Philip Guenther)]

jamie <batsy () VAPOUR NET> writes:
> Here's a heads up to anyone running procmail v3.11pre4.
>
> In the procmailex man page there is an example of a simple fileserver.
> The problem with the example is that after getting it working, I wanted
> to see if the MAILDIR variable would isolate procmail to that directory.
The manpage you quote dates from procmail 3.06 or so.  3.10 and later
have correctly paranoid manpages.


> :0
>              * !^X-Loop: yourname () your main mail address
>              * !^Subject:.*Re:
>              * !^FROM_DAEMON
>              * ^Subject:.*request
>              {
...

Solution: change that last subject to read:

               * ^Subject:.*request [0-9a-z]

and add the condition:

               * ! ^Subject:.*[/.]\.

That will protect you from ".."s and keep dot files in general from
being fetched.  Totally ripping out the entire recipe and inserting
the version from the version 3.11pre* manpage would probably be a
good idea, assuming you have at least 3.10.

(Note: procmail regexps are case insensitive by default)


Philip Guenther

----------------------------------------------------------------
Philip Guenther                 UNIX Systems and Network Administrator
Internet: guenther () gac edu      Voicenet: (507) 933-7596
Gustavus Adolphus College       St. Peter, MN 56082-1498