Cygwin, win98, SA, Perl IO::Socket (Insecure dependency)

[Bryan Hoover <bhoover at wecs dot com>]

Greetings,

Not sure where to go for help with this.  I've googled, and searched
newsgroups relative to Cygwin, Perl, and of course, SpamAssassin, to no
avail, though I know it's quite possible this problem's aready been
touched on...

Running SpamAssassin 2.63, on Cygwin (latest dll (and previous), version
1.5.6-1), with win98, Perl 5.8.2, Net::DNS .45, I'm getting:

Failed to run NO_DNS_FOR_FROM SpamAssassin test, skipping:
        (Insecure dependency in connect while running with -T switch at
/usr/lib/perl5/5.8.2/cygwin-thread-multi-64int/IO/Socket.pm line 114.
)

Note, this is not the Razor related problem.  I'm not running Razor on
the above system.

The strange thing is, this error is only triggered with certain Reply-To
or From header values in the email on which I run SpamAssassin (SA uses
one or the other, in that order).  For instance, if change the input
email so that the From, or Reply-to header value is, say test@yahoo.com,
all goes well.  

The error is triggered on domain, customoffers.com, and this, on my
system as described above, is faithfully reproducible.

Though the Net::DNS demos, mx, perldig, both return good results -- 24
mx records, just as that returned when I run SA with the same email
message on my ISP's freeBSD server.

I've tried playing with SA's input to Net::DNS::mx -- the call
originates in SA's EvalTests.pm, in sub check_for_from_dns:

my @mx = Net::DNS::mx($self->{res}, $from);

-- untainting $from, though it was already assigned the $1 resulting
from a regular expression used to remove the email address before, and
including the @ symbol -- to get customoffers.com.

I also changed EvalTests' parameters to mx, passing in string literals,
and that's about where I discovered that it didn't have any problems
with other addresses -- just the customoffers.com address.  The error
was returned regardless of whether customoffers.com was a literal, and
even if I removed the $self->(res) resolver parameter entirely -- which
mx will compensate for by simply creating a resolver of its own.

I've also tried different versions of SA 2.60, 2.61, with the same
results.

SA has no problem with this email on freeBSD, and mx, and perldig on
Cygwin are Okay with it too.  So I'm having trouble pinning down the
problem here.

I must admit that I'm relatively new with regards to the internals, and
such, of the programatic, system elements involved here.  That said, as
near as I can tell, there appears to be a problem.  Any help much
appreciated.

I've attached the associated spam email, in case of interest.

Bryan
-- 
As a rule I sit quite still, but whenever I move I make a huge leap to
the horror of all those to whom I am bound by the tender bonds of
kinship and friendship. - (Soren Kierkegaard - Either/Or)

http://www.wecs.com/content.htm

This signature file is generated by Pick-a-Tag !
Written by Jeroen van Vaarsel
http://www.google.com/search?hl=en&ie=ISO-8859-1&q=pick-a-tag

Message-ID: <md5:0BAF87648DB4F37514387888E69CCDDF>
Return-Path: <OWNER-NOLIST-3127*BHOOVER**WECS*-COM@OC1.CUSTOMOFFERS.COM>
Delivered-To: bhoover-wecs:com-BHOOVER@WECS.COM
X-Envelope-To: bhoover@wecs.com
Received: (qmail 6684 invoked from network); 25 Jun 2002 03:29:15 -0000
Received: from om3.customoffers.com (66.119.42.142)
  by coll.pair.com with SMTP; 25 Jun 2002 03:29:15 -0000
Received: from OC3 (oc3.customoffers.com) by om3.customoffers.com (LSMTP for
 Windows NT v1.1b) with SMTP id <2.0045960B@om3.customoffers.com>; Mon, 24 J
un 2002 22:46:16 -0400
Date: Mon, 24 Jun 2002 22:39:15 -0400
From: "Consumer Direct Info" <ConsumerDirectInfo@customoffers.com>
Subject: Automatic Enrollment Notice
Reply-to: mailings@customoffers.com
To: BHOOVER@WECS.COM
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="06986E0E1E196312E032AFBC"
X-MD5-Checksum: f6a0d669b1b273858d068bc215a8d473
Old-Reply-To: mailings@customoffers.com
X-Spam-Status: No, hits=3.6 required=5.0
        tests=DEAR_SOMEBODY,CLICK_BELOW,EXCUSE_14,SUPERLONG_LINE,
              WEB_BUGS,FREQ_SPAM_PHRASE
        version=2.30
X-Spam-Level: ***
X-SpamBouncer: 1.4 (10/07/01)
X-SBNote: From Admin
X-SBPass: No Freemail Filtering
X-SBClass: Admin
X-Folder: Bulk
X-Mozilla-Status: 2001

This is a multi-part message in MIME format.
If you are reading this text, you may want to consider changing to a
mail reader or gateway that understands
how to properly handle MIME multipart messages.

--06986E0E1E196312E032AFBC
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Dear Member,

As a valued member of Consumer Direct Info, we are proud to bring you news o
f our latest relationship with CustomOffers.com, and automatically enroll yo
u in their fabulous network. We thought you'd be interested because they too
 deliver valuable discounts, special offers, sweepstakes, and entertainment
reviews from companies such as AOL/Time Warner, AT&T, Sears, BMG, Chase and
Earthlink! So you can begin gaining all the advantages of membership, Custom
Offers has already enrolled you to receive your emails introducing you to th
e "best of the web".

If you do not wish to receive any email offers from the CustomOffers Network
, simply click on the link below for an automatic deletion. It's that easy.

Your Friends at Consumer Direct Info.


If you do not wish to receive email from CustomOffers, please click or copy
and paste the following address into your browser:
http://web1.customoffers.com/optout_pixel.asp?email=BHOOVER@WECS.COM&company
_id=386

http://www.customoffers.com/privacy.html


--06986E0E1E196312E032AFBC
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

<html>
<body>
Dear Member,<p>

As a valued member of Consumer Direct Info, we are proud to bring you news o
f our latest relationship with CustomOffers.com, and automatically enroll yo
u in their fabulous network. We thought you'd be interested because they too
 deliver valuable discounts, special offers, sweepstakes, and entertainment
reviews from companies such as AOL/Time Warner, AT&T, Sears, BMG, Chase and
Earthlink! So you can begin gaining all the advantages of membership, Custom
Offers has already enrolled you to receive your emails introducing you to th
e "best of the web".<p>

If you do not wish to receive any email offers from the CustomOffers Network
, simply click on the link below for an automatic deletion. It's that easy.<
p>

Your Friends at Consumer Direct Info.<p><br>


If you do not wish to receive email from CustomOffers, please click or copy
and paste the following address into your browser:<br><a href="http://web1.c
ustomoffers.com/optout_pixel.asp?email=BHOOVER@WECS.COM&company_id=386" targ
et="_blank">http://web1.customoffers.com/optout_pixel.asp?email=BHOOVER@WECS
.COM&company_id=386</a><p><br>


<a href="http://www.customoffers.com/privacy.html"; target="_blank"> http://w
ww.customoffers.com/privacy.html</a>
<img border=0 height="1" width="1" src=http://www.customoffers.com/realtime.
asp?company_id=386&USER_ID=731677211>
</body>
</html>


--06986E0E1E196312E032AFBC--


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/