3 ms·

This had a showstopper bug a few years ago that could completely compromise a host. I don't usually need this, so I disable it. https://blog.qualys.com/vulner

• paulnpace 4y ago
  The problem I find with this line of reasoning is at the end of the evaluation I've disconnected from all networks and powered down the devices after uninstalling all of the operating systems.
• ori_b 4y ago
  The postmortem is worth reading: https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissected/ https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissec... It's worth reading through the systemic mitigations that would make a clone of this bug impossible in the future.
  • chasil 4y ago
    Interesting that the problem was introduced in a major architecture change to external MDAs, invoked with system(), and was specific to mbox format that requires elevated privilege. I think that I will keep this disabled.
• asveikau 4y ago
  They actually had a few really bad code execution bugs in a tight space of time a few years ago when someone was auditing it. It's a good idea to subscribe to announce@openbsd.org if you run this daemon to get notified of issues. I was running it out of ports on FreeBSD at that time, and wound up patching from source because i didn't want to wait for the ports tree to update. I still see attempts to exploit these bugs in my logs. Even though they've been patched for years. That said, it's good that these were exposed and fixed, as opposed to not found. It's a relatively new daemon compared to other mail servers and it was still ironing things out.