Relaying - No Idea how? 1

[freeb26]

Hi Guys,

My sendmail server running on FC5 appears to be relaying mail from outside and I am not sure how. My /etc/mail/access file looks fine and when I run open relay test they show relaying denied. However I am seeing my mailq fill up and if I tail my logs I see mail going out like crazy.


Here is one example
Mar 27 19:01:01 jupiter sendmail[2992]: l2RN0YaT002990: to=<chapfwrs4@bellsouth.net>, ctladdr=<nobody@jupiter.noname.com> (99/99), delay=00:00:26, xdelay=00:00:01, mailer=esmtp, pri=3001432, relay=mx00.mail.bellsouth.net. [205.152.58.32], dsn=2.0.0, stat=Sent (ok: Message 1006193844 accepted)


Does anyone have a clue bearing in mind I may be the problem?

 

[freeb26]

I found the solution. It is a PHP mail injection exploit. Who knew this was possible.

Here is the solution.

http://www.phpit.net/article/php-security-3-example-exploits/

 

[rtichnor]

Star for you.

How did you figure this out?