Spamattac on server

[cosito]

Hello,

i got lots of spams in the server-outq from root@www.myserver.com.

I can see this in Plesk->Server->Mail->Mail-Outqueue

How can i avoid this issue.


Here is a header of the Mail:

Received: (qmail 2150 invoked by uid 30); 5 Sep 2006 23:03:21 +0200
Date: 5 Sep 2006 23:03:21 +0200
Message-ID: <20060905210321.2149.qmail@www.myserver.com>
To: the8465@otherdomain_on_my_server.com
Subject: the8465@otherdomain_on_my_server.com
MIME-Version: 1.0
From: ham@www.myserver.com
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain
X-Mailer: AOL 6.0 for Windows CA sub 92
Subject: hand, much of the flavour

In Plesk i can see other receivers than in the header:

axelblade@aol.com bmguichon@aol.com jiilinhamden@aol.com arthause@aol.com bohcefus@aol.com teak854@aol.com undinemewes@aol.com daddysgurl919@aol.com

What is this, wher does it come from and how can i avoid this.

Thanks a lot

 

[DigitalCrowd]

I've had two issues today in which customers "Contact Us" forms on their site where being used to send out spam.

This was on one site with a form-mail type script, someone running X-Cart and another running another web site application like Word Press and other like minded apps.

Removing those vulnerable code pages and contacting the customer fixed the issue.

 

[cosito]

There was no website on www.myserver.com

Ther was also no application on the site.

The spams look like systemmails from root.

 

[lvalics]

See this article
http://www.securephpwiki.com/index.php/Email_Injection?seenIEPage=1

I suggest Mod_Security ... works perfect.

 

[timtrott]

Originally posted by DigitalCrowd

This was on one site with a form-mail type script, someone running X-Cart and another running another web site application like Word Press and other like minded apps.

Removing those vulnerable code pages and contacting the customer fixed the issue.

Which version of X-Cart was running and what did you remove to solve the problem? There have been several patches and updates for x-cart very recently. Or did you delete the newsletter php file?