On Tue, Mar 13, 2018 at 07:07:59PM -0700, via RT wrote:
Show quoted text> This is forward of transaction #1776515 of a ticket #124769
Show quoted text> #!perl
> #use warnings;
> #use strict;
> use Net::SMTP;
> my $smtp = Net::SMTP->new("localhost",
> Hello => 'my.host.com',
> Timeout => 60);
> $smtp->mail("whitehat002\@hotmail.com");
> $smtp->to("499671216\@qq.com\n");
> $smtp->data();
> $smtp->datasend("From: whitehat002\@hotmail.com\nSubject: command inject\n");
> $smtp->datasend("To: 499671216\@qq.com\n");
> $smtp->quit;
> print "send success\n";
>
>
> --------------------------
>
> command inject
>
> From:whitehat002 <whitehat002@hotmail.com>
> Date:Wednesday, Mar 14, 2018 9:59 AM
> To: 道隐无名 <499671216@qq.com>
>
> Hello,perl security team,
> Now I use smtp module，and I can inject command success.Another ticket #124765 should be closed,thanks.
Please can you stop raising the same issue (with the same email) to both
rt.cpan.org ticket and a perl5-security at the same time, Pick one or the
other. Otherwise it's very confusing for the automated systems and the
people reading the emails.
Also, rt.cpan.org is public, while perl5-security isn't. Raising the issue
on both systems simultaneously means any sensitive information has already
been made public.
If you think there is an issue with Net::SMTP then you should have raised
a ticket with the distribution which contains that module, i.e. libnet,
NOT SMTP-Server.
In any case, what you have shown is not a command injection, nor is it a
security issue; Net::SMTP is behaving exactly as it should.
I'm closing the perl security ticket now,
--
Red sky at night - gerroff my land!
Red sky at morning - gerroff my land!
-- old farmers' sayings #14
