Re: [cobalt-users] POP before SMTP, Open relay still open

["Jonathan Michaelson" <michaelsonjd@xxxxxxxxxxx>]

> > Either yesterday or even earlier today, a hack was posted to close the
> > vulnerability.  You should find it here:
> > http://list.cobalt.com/pipermail/cobalt-security/2001-July/002689.html
>
> I applied the hack as directed, although I am on a RaQ3, and it is still
> allowing the relay :( Has anyone successfully patched a RaQ3 yet?

If you tested the exploit before applying the hack, did you delete the
offending IP from the poprelayd database before running the exploit again?

To do so, use the following to list the IP's in the database:
perl /usr/local/sbin/poprelayd -p

And use the following to delete the offending IP (e.g. 66.66.66.66):
perl /usr/local/sbin/poprelayd -r 66.66.66.66

Now add the hack and test the exploit to see if 66.66.66.66 is re-entered
into the poprelayd d/b.

Regards,
Jonathan Michaelson
Way to the Web Ltd
Commercial Perl CGI Scripting