Evolution of the MTA architecture: The impact of security

Software - Practice and Experience

Volumn 38, Issue 15, 2008, Pages 1569-1599

  Hafiz, Munawar ^a   Johnson, Ralph E ^a  

^a University of Illinois at Urbana Champaign   (United States)

Author keywords

Mail transfer agent (MTA); Security patterns; Software architecture

Indexed keywords

COMPETITION; DESIGN; MILITARY AIRPORTS; SOFTWARE AGENTS;

MAIL TRANSFER AGENT (MTA); SECURITY PATTERNS;

SOFTWARE ARCHITECTURE;

EID: 57049183633     PISSN: 00380644     EISSN: 1097024X     Source Type: Journal    
DOI: 10.1002/spe.880     Document Type: Article

References (58)

1. sendmail home page. Maintained by Sendmail Consortium, http://www.sendmail.org [1 January 2008].
2. E-Soft. Mail(MX) server survey. http://www.sccurityspace.com/s-survey/ data/man.200709/mxsurvey.html [1 September 2007].
3. Simpson K, Bekman S. Fingerprinting the world's mail servers. O'Reilly SysAdmin, January 2007.
4. qmail home page. Maintained by Daniel Julius Bernstein, http://cr.yp.to/qmail.html [1 January 2008].
5. Postfix home page. Maintained by Wietse Zweitze Venema. http://www.postfix.org [1 January 2008].
6. Parnas DL, Clements PC. A rational design process: How and why to fake it. Proceedings of the International Joint Conference on Theory and Practice of Software Development (TAPSOFT) on Formal Methods and Software, vol. 2: Colloquium on Software Engineering (CSE). Springer: New York, NY, U.S.A., 1985; 80-100.
7. Viega J, McGraw G. Building Secure Software - How to Avoid Security Problems the Right Way. Addison-Wesley: Reading, MA, 2001.
8. ̃ma/postfix/bench2.html [26 April 2006].
9. ̃ma/postfix/vsqmail.html [21 May 2002].
10. Venema WZ. Postfix performance results, http://www.porcupine.org/postfix/ performance.html [9 June 1997].
11. Kazman R, Klein M, Clements P. ATAM: Method for architecture evaluation [2000].
12. Beck K, Johnson R. Patterns Generate Architectures (Lecture Notes in Computer Science, vol. 821). Springer: Berlin, 1994; 139-149.
13. Klensin J (ed.). Simple mail transfer protocol. RFC 2821, April 2001.
14. Postel JB. Simple mail transfer protocol. RFC 821, August 1982.
15. Klensin J, Freed N, Rose M, Stefferud E, Crocker D. SMTP service extensions. RFC 1651, July 1994.
16. Myers J. Local mail transfer protocol. RFC 2033, October 1996.
17. BugTraq ID 3377. sendmail inadequate privilege lowering vulnerability, http://www.securityfocus.com/bid/3377 [2001].
18. Bernstein DJ. sendmail disasters, http://cr.yp.to/maildisasters/sendmail. html [1997].
19. Security Focus, sendmail vulnerabilities, http://www.securityfocus.com/ bid.
20. BugTraq ID 19714. sendmail long header denial of service vulnerability, http://www.securityfocus.com/bid/19714 [2006].
21. BugTraq ID 23606. sendmail unspecified denial of service vulnerability, http://www.securityfocus.com/bid/23606 [2001].
22. Swiderski F, Snyder W. Threat Modeling. Microsoft Press: Buffalo, NY, U.S.A., 2004.
23. Shearer D. MTAs - Choose the tool for the job. http://shearcr.org/en/ writing/mtacomparison.html [June 2001].
24. FWTK documentation. http://www.fwtk.org/fwtk/does/documentation.html [1 January 2008].
25. Zhong Q, Edwards N. Security control for COTS components. Computer 1998; 31(6):67-73.
26. Veryard R, Ward A. Trusting components and services. http://www. cbdiforum.com/report-summary.php3?topic-id=23&report=411&order= author&start-rec= 15 [2001].
27. Hafiz M. Security architecture of mail transfer agents. Master's Thesis, University of Illinois at Urbana-Champaign, 2005.
28. Hafiz M. Unique atomic chunks: A pattern for security and reliability. Proceedings of the 11th Conference on Patterns Language of Programming (PLoP'04), Monticello, IL, U.S.A., 2004.
29. Peek J. MH & xmh: Email for Users & Programmers. O'Reilly & Associates: Sebastopol, CA, U.S.A., 1995.
30. Blakley B, Heath C. Security design patterns technical guide - Version 1. Open Group (OG), led by Bob Blakley and Craig Heath, http://www.opengroup.org/ security/gsp.htm [2004].
31. Hafiz M, Johnson R, Afandi R. The security architecture of qmail. Proceedings of the 11th Conference on Patterns Language of Programming (PLoP'04), Monticello, IL, U.S.A., 2004.
32. Bernstein DJ. Quick mail transfer protocol (QMTP). http://cr.yp.to/proto/ qmtp.txt [1997].
33. Bernstein DJ. QMQP: Quick mail queueing protocol, http://cr.yp.to/proto/ qmqp.html [1997].
34. Aleph One. Smashing the stack for fun and profit. Phrack Magazine 1996; 7(49):File 14.
35. BugTraq ID 13528. qmail alloc() remote integer overflow vulnerability, http://www.securityfocus.com/bid/13528 [2005].
36. BugTraq ID 13535. qmail commands () function remote integer overflow vulnerability. http://www.sccurityfocus.com/bid/13535 [2005].
37. BugTraq ID 13536. qmail substdio-put () function remote integer overflow vulnerability. http://www.sccurityfocus.com/bid/13536 [2005].
38. BugTraq ID 9797. qmail-qmtpd RELAYCLIENT environment variable integer overflow vulnerability. http://www.securityfocus.com/bid/9797 [2004].
39. BugTraq ID 9432. qmail-smtpd long SMTP session integer overflow denial of service vulnerability. http://www.securityfocus.com/bid/9432 [2004].
40. Bernstein DJ. The qmail security guarantee, http://cr.yp.to/qmail/ guarantee.html [2005].
41. 928 F.2d 504. United States of America, Appellee v. Robert Tappan Morris, Defendant-Appellant. No. 774, Docket 90-1336, US court of appeals, Second circuit. Argued December 1990. Decided March 1991.
42. Eichin MW, Rochlis JA. With microscope and tweezers: An analysis of the Internet virus of November 1988. IEEE Symposium on Research in Security and Privacy, Oakland, OH, U.S.A., 1989; 326-343.
43. Venema WZ. Denial of service (qmail-smtpd). qmail mailing list. http://www.ornl.gov/lists/mailing-lists/qmail/1997/06/msg00317.html [11 June 1997].
44. Bernstein DJ. Time for a reality check. qmail mailing list. http://www.ornl.gov/lists/mailing-lists/qmail/1997/06/msg00500.html [13 June 1997].
45. McKusick MK, Ganger GR. Soft updates: A technique for eliminating most synchronous writes in the fast filesystem. Proceedings of the FREEN1X Track (FREEN1X-99), USENIX Association, Monterey, CA, U.S.A., 1999; 1-18.
46. Bernstein DJ. Reliability, http://cr.yp.to/qmail/faq/reliability. html#filesystems [1997|.
47. chroot(), Unix man pages.
48. Friedl S. Go directly to jail: Secure untrusted applications with chroot. Linux Magazine, December 2002. http://www.hnux-mag.com/2002-12/chroot- 01.html.
49. Gröne B, Kniipfel A, Kugel R, Schmidt O. The Apache modeling project, http://www.f-m-c.org/projects/apache/htm Apache-Modeling-Project.html [2004].
50. Hafiz M. Secure pre-forking: A pattern for security and performance. Proceedings of the 12th Conference on Patterns Language of Programming (PLoP'05), Monticello, IL, U.S.A., 2005.
51. Sill D. Life with qmail. http://www.lifcwithqmail.org/lwq.html [2006].
52. Hazel P. PCRE - Perl-compatible regular expressions, PCRE man pages, http://www.pcre.org/pcre.txt [2000].
53. Yoder J, Barcalow J. Architectural patterns for enabling application security. Proceedings of the 4th Conference on Patterns Language of Programming (PLoP'97), Monticello, IL, U.S.A., 1997.
54. Messaging Anti-Abuse Working Group (MAAWG). Email metrics program: The network operators' perspective. http://www.maawg.org/about/EMR [June 2007].
55. Hafiz M. Security patterns and evolution of MTA architecture. OOPSLA '05: Companion to the 20th Annual ACM SIGPLAN Conference on Object-oriented Programming, Systems, Languages, and Applications. ACM Press: New York, NY, U.S.A., 2005; 142-143.
56. Costales B, Allman E. Sendmail O'Reilly & Associates, Inc.: Sebastopol, CA, U.S.A., 2003.
57. Aßmann C. MeTAl README, http://www.metal.org/does.html [January 2007].
58. Aßmann C. sendmail X: Requirements, architecture, functional specification, implementation, and performance. Technical Report, Sendmail Inc., September 2004.