Full mailspool after updating Roundcube

[Nego]

Yesterday i updated Roundcube to its new version.

Today i was checking the mailpool and this resulted in 58 pages of frozen email:


-----------


1LeMAk-00029x-0L-D
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

[email protected]l
Unrouteable address

------ This is a copy of the message, including all the headers. ------

Return-path: <[email protected]>
Received: from apache by GJF001.local with local (Exim 4.67)
(envelope-from <[email protected]>)
id 1LeMAj-00029v-Vz
for [email protected]l; Tue, 03 Mar 2009 05:24:02 +0100
From: [email protected]l (Cron Daemon)
To: [email protected]l
Subject: Cron <apache@GJF001> perl /tmp/tmpfile
Content-Type: text/plain; charset=ANSI_X3.4-1968
X-Cron-Env: <SHELL=/bin/sh>
X-Cron-Env: <HOME=/var/www>
X-Cron-Env: <PATH=/usr/bin:/bin>
X-Cron-Env: <LOGNAME=apache>
Message-Id: <[email protected]>
Date: Tue, 03 Mar 2009 05:24:01 +0100

Can't open perl script "/tmp/tmpfile": No such file or directory

2009-03-03 05:24:02 Received from <> R=1LeMAj-00029v-Vz U=mail P=local S=1401 T="Mail delivery failed: returning message to sender"
2009-03-03 05:24:02 routing failed for [email protected]l F=<>: Unrouteable address
*** Frozen (delivery error message)





Someone who knows what to do with it?

 

[scsi]

Delete the frozen emails then check your server to make sure it is not infected with anything.

 

[Nego]

I understand but what causes this?

 

[scsi]

The addresses are not routable or cannot be delivered to the hosts they are intended for.

 

[nobaloney]

scsi, and Nego,

Did you read that email? Someone has probably put some some software on the server that's attempting to compromise the server. It may or may not be compromised already.

Keys to understanding this:

[email protected]

Can't open perl script "/tmp/tmpfile": No such file or directory

Jeff

 

[Nego]

scsi, and Nego,

Did you read that email? Someone has probably put some some software on the server that's attempting to compromise the server. It may or may not be compromised already.

Keys to understanding this:




Jeff

Well it hapens after i updated Roundcube. Im receiving a new email in the spool every minute?
I want to know what causes this to disable it

EDIT:
I found this in the Crontab of user Apache:
\*/1 * * * * perl /tmp/tmpfile

This isnt needed i think?

 

[nobaloney]

No; it's evidence of a compromise, probably of Roundcube. Did you fix roundcube? Remove that cronjob if you haven't already. And clean up your /tmp directory.

Jeff