Re: What attack is this one?

2011-02-12 Thread Bob Proulx
Sahil Tandon wrote: > Bob Proulx wrote: > > The remote mta security exploit I couldn't locate references to was > > the "to= > vulnerable to "+:|" in the To address? Or perhaps none are and this > > is simply a failed probe attempt? > > Likely related to CVE-2010-1132: > > http://cve.mitre.org/

Re: What attack is this one?

2011-02-12 Thread Sahil Tandon
On Sat, 2011-02-12 at 14:53:53 -0700, Bob Proulx wrote: > A friend's Mac running Postfix logged this rejected attack: > > Feb 11 21:45:28 mailer postfix/smtpd[3708]: NOQUEUE: reject: RCPT > from unknown[216.104.47.74]: 504 5.5.2 : Helo command > rejected: need fully-qualified hostname; from

What attack is this one?

2011-02-12 Thread Bob Proulx
A friend's Mac running Postfix logged this rejected attack: Feb 11 21:45:28 mailer postfix/smtpd[3708]: NOQUEUE: reject: RCPT from unknown[216.104.47.74]: 504 5.5.2 : Helo command rejected: need fully-qualified hostname; from= to=&0 2>&0> proto=SMTP helo= Of course this particular message was

Re: OT: How to resolve big ISP mail drop

2011-02-12 Thread john
If, and its a big if, they are respecting the various RFCs that cover email then email to postmaster or abuse should get through. But as it is a big IF> On 11/02/2011 12:15 PM, Gary Smith wrote: Anyway, the question is, how does the community as a whole deal with big ISP's losing email? It s

Re: OT: How to resolve big ISP mail drop

2011-02-12 Thread Andrew Beverley
On Fri, 2011-02-11 at 13:25 -0500, Kris Deugau wrote: > Gary Smith wrote: > >>> Anyway, the question is, how does the community as a whole deal with > >>> big ISP's losing email? It seems that some companies (like ATT) seem > >>> to have less and less access to tools necessary for communicating