Ted Leung on the air
Ted Leung on the air: Open Source, Java, Python, and ...
Ted Leung on the air: Open Source, Java, Python, and ...
Sat, 21 Feb 2004
pyblosxom comment spam fix
If you are using the pyblosxom comments plugin, you should update to the latest version from CVS (or you can download it from my home page. There's a new comment spam program running around that tries to exploit weaknesses in comment systems and use it to send e-mail on its behalf.
In the case of pyblosxom, the attack works if you have SMTP notification of comments turned on. If you have comment notification turned on, the attacking program injects the commands for a complete SMTP transaction into the fields for the comment form. The way that Python's smtplib works is to jam text into the SMTP connection. So if the body of the comment happens to look like this:
[22:38] |
[computers/internet/weblogs/pyblosxom] |
# |
TB |
F |
G |
0 Comments |
blasterattacko@aol.com To: blasterattacko@aol.com From: blasterattacko@aol.com Subject: PyC(5D9A983C,url)dlq9F UeFb8RE4XhzEn6 9dwVwadJWbqLXc2EjtIcmkc9Q7f1aeAnNqR .the entire thing gets sent to the SMTP connection as the body of the e-mail. The updated plugin wraps To: From: and Subject: in the comment body in html tags, so a comment that has that data in it will still display, but will be illegal as SMTP commands.
You can subscribe to an RSS feed of the comments for this blog:
Add a comment here:
You can use some HTML tags in the comment text:
To insert a URI, just type it -- no need to write an anchor tag.
Allowable html tags are:
You can also use some Wiki style:
URI => [uri title]
<em> => _emphasized text_
<b> => *bold text*
Ordered list => consecutive lines starting spaces and an asterisk
Add a comment here:
You can use some HTML tags in the comment text:To insert a URI, just type it -- no need to write an anchor tag.
Allowable html tags are:
<a href>, <em>, <i>, <b>, <blockquote>, <br/>, <p>, <code>, <pre>, <cite>, <sub> and <sup>.You can also use some Wiki style:
URI => [uri title]
<em> => _emphasized text_
<b> => *bold text*
Ordered list => consecutive lines starting spaces and an asterisk
![[Valid RSS]](http://www.sauria.com/blog/images/valid-rss.png "Validate my RSS feed"){kind=small}
