RE: [cobalt-users] Spammer sending from httpd on our RaQ3

[Graeme Fowler <graeme.fowler@xxxxxxxxxxxxxx>]

Paul Johnson wrote:

> Someone is sending spam via one of our RaQs, they've 
> apparently found a way to send mail as if it were coming
> from the http daemon.
> Not sure just how to disable this, particularly in a way
> that the GUI won't re-enable next time we add an email
> account.  Any ideas?  

Yep. And it IS coming from the http daemon, which means it's being generated
by a web page, which means your next statement is pretty well null and
void...

> We've always kept the machine up to date with patches from
> Cobalt.  No indication of any hacks to the machine.

...you have, most likely, by an old version of FormMail.pl on one of your
sites. This is renowned for spamming, since it allows people to manipulate
the form entry fields directly and then send emails from addresses not on
your server.

Find formmail.pl and make sure it's a new version.

http://www.worldwidemart.com/scripts/formmail.shtml

should see you right.

Graeme
-- 
Graeme Fowler
System Administrator
Host Europe Group PLC