i'm receiving lots of virus emails! i'm receiving lots of virus emails!
 

News:

cpg1.5.48 Security release - upgrade mandatory!
The Coppermine development team is releasing a security update for Coppermine in order to counter a recently discovered vulnerability. It is important that all users who run version cpg1.5.46 or older update to this latest version as soon as possible.
[more]

Main Menu

i'm receiving lots of virus emails!

Started by nova-bossa, July 28, 2004, 06:22:21 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

nova-bossa

in the last months i received lots of emails with virus attachments.
today i changed the email address of my gallery to a new one and just some hours later i received there my first email with a virus attached. so i conclude the email address of my gallery is beeing found on the net by these email virus.

is the gallery email address somehow not protected? this is crazy!

Joachim Müller

I've re-checked the source code - I haven't found any instance where the gallery admin email address should be visible to the public.
Are you sure you haven't set up a catch-all on your new email address? Also, make sure the address is non-trivial (don't use webmaster@mydomain.com or similar, instead use my.email.addy@mydomain.com).

What version of coppermine are you running btw?

GauGau

nova-bossa

i use version 1.3.0.
my new email address is a free fastmail webbased and has no catch-all feature.

the email address is not visible but is it possible that it gets somehow "crawled" by net viruses or worms?

Joachim Müller

there are lots of known scripts and backdoors that extract valid email addresses out of freemail provider's lists. I know there are exploits against hotmail.com, gmx.de, web.de.
The exploit works like this: you have a script that sends thousands of emails to made up addresses of a certain free mailer domain. Depending on the fact if the address exists the server will send back different answers.

If you really want to proof that coppermine is to blame, you will have to use a "real" genuine email address on a domain that is not related to freemailing.

GauGau