DSA-3747-1 exim4 - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3747-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-9963

It was found that Exim leaked DKIM signing private keys to the "mainlog" log file. As a result, an attacker with access to system log files could potentially access these leaked DKIM private keys...

CVE-2016-9963

Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages...

exim -- DKIM private key leak

The Exim project reports: Exim leaks the private DKIM signing key to the log files. Additionally, if the build option EXPERIMENTALDSNINFO=yes is used, the key material is included in the bounce message...

Office 365 Vulnerability Identified Bogus Email as Valid

Details have been released on a simple Office 365 hack that incorrectly identifies spoofed emails pretending to be from the Microsoft.com domain as valid. The vulnerability being targeted was privately disclosed by Turkish security researcher Utku Sen, and was patched by Microsoft this month...

New Gmail Alerts Warn of Unauthenticated Senders

Google is expected soon to begin a gradual rollout of new security features in Gmail that warn users if the system could not authenticate the sender of an email message. Starting this week for browser-based users of Gmail and Android users, Google will display a question mark over a sender’s...

arxius: No SPF/DKIM/DMARC Record for lfil.es

For some reason he requested to disclose a duplicate report that's n/a anyway, so why not...

Paragon Initiative Enterprises: Email Authentication Bypass

Hi, I was able to bypass you email authentication. You have not published "DMARC Domain-based Message Authentication, Reporting, and Conformance" for the domain paragonie.com more information :- http://dmarc.org/ ---------------------------------------------------------------------- what is DMARC...

New Relic: Too many included lookups

Your SPF record required more than 10 DNS Lookups to be performed during the test. The number of "include" mechanisms and chained "redirect' modifiers should be kept to a minimum. According to RFC 4408, 'SPF implementations MUST limit the number of mechanisms and modifiers that do DNS Lookups to ...

LeaseWeb: MISSING SPF RECORDS & MISSING DKIM POLICY

Missing SPF Records and DKIM policy ----------------------------------------------------- At this moment the leaseweb.com domain is missing the appropriate SPF records and DKIM policy. We are aware of the attack scenarios and currently working on a solution. We will add the missing SPF records an...

Gratipay: SPF/DKIM/DMARC for aspen.io

1.aspen.io 2.grtp.co SPF record lookup and validation for: grtp.co SPF records are published in DNS as TXT records. The TXT records found for your domain are: Checking to see if there is a valid SPF record. No valid SPF record found of either type TXT or type SPF. SPF record lookup and validation...

Gratipay: SPF/DKIM/DMARC for grtp.co

Hello Security Team, I Was Checking The SPF Record For https://grtp.co/ at http://www.kitterman.com/spf/validate.html No valid SPF record found of either type TXT or type SPF. Kindly Fix it Asap! Thanks!...

Paragon Initiative Enterprises: Email Authentication bypass Vulnerability

Hi, I was able to bypass you email authentication. You have not published "DMARC Domain-based Message Authentication, Reporting, and Conformance" for the domain paragonie.com more information :- http://dmarc.org/ ---------------------------------------------------------------------- what is DMARC...

VMWare Zimbra Mailer Release 8.6.0.GA Replay Attack

Hi@all, VMWare Zimbra Mailer Release 8.6.0.GA, latest patch and prior versions with DKIM implementation are vulnerable to longterm Mail Replay attacks. If the expiration header is not set, the signature never expires. This means, that the e-mail, perhaps catched while performing a man in the midd...

Google Moving Gmail to Strict DMARC Implementation

By next summer, most of the major Web-based email providers will have implemented a policy of strictly adopting the DMARC protocol. Google, in a statement published Tuesday by DMARC.org, said it will move gmail.com to a policy of rejecting any messages that don’t pass the authentication checks...

Gratipay: SPF Protection not used, I can hijack your email server

Description Companies like Twiter,Facebook and even Hackerone implemented a strict email security policy combining SPF, DKIM, and DMARC but I don't see that from gratipay You should apply strict SMPT policy to stop spoofed email sending from your domain. POC is attached. Exploit scenario: An...

Coinbase: SPF records not found

There is no TXT record in DNS zone that defines Sender Policy Framework entry for domain api.coinbase.com. These are the best practices and need to be configure in DNS records to protect your mail servers. using SPF records will help in spam filtering as SPF records does helps in verifying the...

Gratipay: DKIM records not present, Email Hijacking is possible

Your SPF record is v=spf1 include:email.freshdesk.com include:spf.mandrillapp.com include:spf.google.com -all Which very well shows that you don't want spoofed email to be sent from your domains, but you just forget one thing: DKIM DomainKeys Identified Mail is an important authentication mechani...

Scientific Linux Security Update : mailman on SL6.x i386/x86_64 (20150722)

It was found that mailman did not sanitize the list name before passing it to certain MTAs. A local attacker could use this flaw to execute arbitrary code as the user running mailman. CVE-2015-2775 It was found that mailman stored private email messages in a world- readable directory. A local use...