procmail
[Top] [All Lists]

Re: Help! Need to use procmail to fight dangerous security exploit

1998-07-28 23:53:59
On Tue, Jul 28, 1998 at 10:18:43PM -0600, Brett Glass wrote:

I would like to try to use procmail to plug the hole at the mail server,
by truncating the excessively long file names in the MIME headers. (Procmail
seems to be the best tool for the job). However, I have no experience with 
procmail. Could someone help me write a procmail.rc that will eliminate the 
extra-long filenames, truncating them back to (say) 64 characters max? 
All that's required is to recognize the header

Content-Disposition: attachment; filename="<verylongname>"

and make sure that <verylongname> is chopped to a reasonable size. Then, I
must learn to install procmail to filter all users' incoming mail.

Brett, 

I came up with an idea after all.  This should work:

CHAR=[-_0-9A-Za-z]

:0
* ^Content-Disposition:[        ]*attachment;[  
]*filename="\/($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)($CHAR)
| formail -I 'Content-Disposition: attachment; filename="$MATCH"'

There are 64 instances of $CHAR present.  The [<space>] each
contain a space and a tab.  The \/ denotes the beginning of matching
into the $MATCH variable, so if it matches, it catches 64 chars of
whatever, then doesn't check for any more.  The formail command takes
that Content-Disposition: header and rewrites it with the contents of
$MATCH instead of whatever was originally there. 

This would be a whole lot easier if procmail implemented bounded
repititions:
...filename="\/($CHAR){0,64}

Regards,

Greg
-- 
Gregory S. Sutter                 Bureaucrats cut red tape -- lengthwise.
mailto:gsutter(_at_)pobox(_dot_)com
http://www.pobox.com/~gsutter/