Bonum Certa Men Certa

Edward Brocklesby: hacker received advance notice of zero-day vulnerabilities in MH and NMH email software

posted by Roy Schestowitz on Jun 15, 2024

Reprinted with permission from Daniel Pocock.

The web page for nmh, a UNIX mail client, tells us that versions prior to 1.0.3 had a back door:

All versions of nmh prior to 1.0.3 (as well as MH) contained a vulnerability where incoming mail messages with carefully designed MIME headers could cause the mhshow command to execute arbitrary shell code.

Brocklesby was maintainer of the MH package and therefore he received advance warning of the security vulnerability in both MH and NMH software. The warning was circulated in the debian-private cubby house approximately four days before a public bug report appeared. He may have received other personal emails or IRC chat messages about the issue before anybody else had time to protect their systems.

Subject: FWD: MH also vulnerable to remote attack (was Re: nmh security update)
Date: Fri, 3 Mar 2000 19:10:19 -0800
From: Joey Hess <joeyh@debian.org>
To: Edward Brocklesby <ejb@debian.org>
CC: security@bugs.debian.org

We've patched nmh, but it looks like mh may be vunerable to the same hole.
----- Forwarded message from Dan Harkless <dan-bugtraq@DILVISH.SPEED.NET> -----
Date: Thu, 2 Mar 2000 16:37:37 -0800 From: Dan Harkless <dan-bugtraq@DILVISH.SPEED.NET> Subject: MH also vulnerable to remote attack (was Re: nmh security update) To: BUGTRAQ@SECURITYFOCUS.COM
Ruud de Rooij <ruud@RUUD.ORG> writes: > Versions prior to 1.0.3 of the nmh package contained a vulnerability > where incoming mail messages with carefully designed MIME headers could > cause nmh's mhshow command to execute arbitrary shell code. > > This bug has been fixed in nmh 1.0.3 and we encourage you to upgrade > immediately. The fixed package is available at > > ftp://ftp.mhost.com/pub/nmh/nmh-1.0.3.tar.gz > > The MD5sum of nmh-1.0.3.tar.gz is 02519bf8f7ff8590ecfbee9f9500ea07.
Please note that the MIME-handling code with the security hole dates back to nmh's ancestor MH, so MH users (at least those using latter-day versions with MIME capability) are also strongly encouraged to upgrade to nmh 1.0.3.
---------------------------------------------------------------------- Dan Harkless | To prevent SPAM contamination, please dan-bugtraq@dilvish.speed.net | do not mention this private email SpeedGate Communications, Inc. | address in Usenet posts. Thank you.
----- End forwarded message -----
-- see shy jo

The rogue elements of Debian spent over $120,000 to attack my family and I with lawyers after my father died. They made no credible inquiry into the activities of real hackers. They only care about making political attacks on volunteers and our families. Security is above their pay grade.

It is now ten days after my first disclosure about the Edward Brocklesby affair and there is no comment whatsoever from the Debian security team. The only comments they make are to attack my family and I, a reprisal for raising another serious security concern.

Read more articles about the mysterious Edward Brocklesby & Debian affair.

Other Recent Techrights' Posts

Why We're Revealing the Ugly Story of What Happened at Libre-SOC
Aside from the fact that some details are public already
Why Virtually All the Wikileaks Copycats, Forks, and Rivals Basically Perished
Cryptome is like the "grandpa" of them all
In the United Kingdom Google Search Rises to All-Time High, Microsoft Fell Nearly 1.5% Since the LLM Hype Began
Microsoft is going to need actual products or it will gradually vanish from the market
 
LWN (Earlier This Week) is GAFAM Openwashing Amplified
Such propaganda and openwashing make one wonder...
Open Source Initiative (OSI) Blog: Microsoft Operatives Promoting Proprietary Software for Microsoft
This is corruption
Libre-SOC Insiders Explain How Libre-SOC and Funding for Libre-SOC (From NLNet) Got 'Hijacked' or Seized
One worked alongside my colleagues and I in 2011
Removing the Lid Off of 'Cancel Culture' (in Tech) and Shutting It Down by Illuminating the Tactics and Key Perpetrators
Corporate militants disguised as "good manners"
FSF, Which Pioneered GNU/Linux Development, Needs 32 More New Members in 2.5 Days
To meet the goal of a roughly month-long campaign
Lupa Statistics, Based on Crawling Geminispace, Will Soon Exceed Scope of 4,000 Capsules
Capsules or unique capsules or online capsules are in the thousands and growing
Links 24/07/2024: Many New Attacks on Journalists, "Private Companies Own The Law"
Links for the day
Gemini Links 24/07/2024: Face à Gaïa, Emacs Timers for Weekly Event, Chromebook Survives Water Torture
Links for the day
A Total Lack of Transparency: Open and Free Technology Community (OFTC) Fails to Explain Why Over 60% of Users Are Gone (Since a Week Ago)
IRC giants have fallen
Trying to Put Out the Fire at Microsoft
Microsoft is drowning in debt while laying off loads of staff, hoping it can turn things around
GNU/Linux Growing at Vista 11's Expense
it's tempting to deduce many people who got PCs with Vista 11 preinstalled are deleting it, only to replace it with GNU/Linux
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, July 23, 2024
IRC logs for Tuesday, July 23, 2024
[Meme] Was He So Productive He Had to be Expelled Somehow? (After He Was Elected and Had Given Many Years of Work to Earn a Board Seat)
Things like these seem to lessen the incentive to devote one's life to Free software projects
GNOME Foundation is Causing Itself More Embarrassment With Secrecy Than With Full Transparency
It also arouses suspicion and hostility towards Codes of Conduct, which gave rise to 'secret courts' governed by large corporations
Links 23/07/2024: NetherRealm Layoffs and Illegitimate Patent 'Courts' (Illegal)
Links for the day
Gemini Links 23/07/2024: AM Radio, ngIRCd, and Munin
Links for the day
A Lot of GNU/Linux Growth on the Client Side is Owing to India (Where GNU/Linux Has Reached 16%)
A lot of this happened in recent years
Insulting Free Software Users in Social Control Media (Proprietary, Bloated With Opaque JavaScript) is Like Insulting Amish on TV
Why bother? Don't take the bait.
When Wikileaks Sources Were Actually Murdered and Wikileaks Was Still a Wiki
when Wikileaks was a young site and still an actual wiki
statCounter: Dutch GNU/Linux Usage Surged 1% in Summer
Microsoft is running out of things to actually sell
Microsoft's "Results" Next Week Will be Ugly (But It'll Lie About Them, as Usual)
Where can Microsoft find income rather than losses as its debt continues to grow and layoffs accelerate?
Julian Assange is Still Being Dehumanised in Media Whose Owners Wikileaks Berated (With Underlying Facts or Leaks)
Wikileaks and Free software aren't the same thing. Nevertheless, the tactics used to infiltrate or discredit both ought to be understood.
A Month Later
We're optimistic on many fronts
Links 23/07/2024: Downsizing and Microsoft and Still Damage Control
Links for the day
Gemini Links 23/07/2024: Friends and Solitaire
Links for the day
Why the Media is Dying (It Sucks, No Mentally Healthy People Will Tolerate This for Long)
linking to actual news articles helps fuel the spam, too
Censorship in Eklektix's Linux Weekly News (LWN)
Medieval system of speech, where the monarchs (Linux Foundation) dictate what's permissible to say
10 Years of In-Depth EPO Coverage at Techrights (Many Others Have Abandoned the Topic)
Listen to staff
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, July 22, 2024
IRC logs for Monday, July 22, 2024
[Meme] The Latest in the Microsoft Windows Blame Game
Microsoft found the culprit and came to everyone's rescue!
Links 22/07/2024: Overworking and Performance Issues From Europe
Links for the day
Microsoft Eliminates 67% of the Building Occupancy - That's Some Truly Massive Layoffs
Half a dozen floors? Microsoft cuts that down to two.
[Meme] Signs of a Dying Patent Office
"Bribe the media to say you excel"
This Month's General Consultative Committee (GCC) Webchat ('Meeting') Covered the European Patent Office's Attacks on Its Own Interpreters
The Central Staff Committee is currently circulating a report with appendices about the GCC meeting [sic] (webchat) that took place less than a fortnight ago
A Byzantine European Patent Office Where Staff Must Beg for Help With Contraception (Worse Than the Rest of Europe)
The Central Staff Committee (EPO staff representation) has just circulated a report
[Teaser] EPO Run by Children
"Daddy, why was I born?"
Let's Encrypt About to Fall Below 100 (Capsules) in Geminispace, It's Basically in a Freefall
The "self-signed" portion keeps growing
Gemini Links 22/07/2024: Spacewalk Dies and Old Computer Challenge in the Rear View
Links for the day
For the First Time Since May Linux.com (Linux Foundation) Published Something. It's All Spam.
Can we trust the Linux Foundation to look after anything at all? Look what it turned this once-thriving site into.
Honduras: Windows Down, Android Peaking Again
Honduras does not have many stakes in Microsoft
[Meme] Twitter (X) Will Reject the Concept of a Female President
Twitter (X) is controlled by misogynists, who socially control (or socially-engineer) their fake concept of "media"
Second Family Photo of Julian Assange Since His Release (First Since His Birthday)
His wife shows the 4 of them for the first time (2 hours ago)
Protesters in Kenya Need Software That is Free (Libre) and Supports Real Encryption in Order to Avoid Capture and Torture (Sometimes Execution)
There's more to fight over than economic issues
The Ludicrous Idea That GNU/Linux is a "Poor Man's" Operating System
Seeing the trends in countries such an Norway, it ought to be abundantly clear that adoption of GNU/Linux has nothing to do with poverty
Links 22/07/2024: Internet Optimism and Kamala Harris Policies Debated
Links for the day
Something is Happening at OFTC
It looks like it shrank by 20,000 users
GNU/Linux Usage in Guadeloupe Rises Closer to International Average, Based on Web Data Collected by statCounter
It should be noted that the estimates of GNU/Linux usage are now in 4.5% territories
The Impact of OFTC's Latest Changes on the Perceived Scale of IRC Globally
IRC is still one of the more potent alternatives to the social control media conglomerates
New: Why They Really Went After Assange
Uploaded by Chris Hedges
Links 21/07/2024: Health, Politics, and Kamala Harris in Focus
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, July 21, 2024
IRC logs for Sunday, July 21, 2024
A Drop in Half (From 208 to 104): Sharp Decline in Number of Gemini Capsules That Use Let's Encrypt CA Since December
Gemini is increasing its independence from Certificate Authorities (CAs)