procmail
[Top] [All Lists]

Re: Help! Need to use procmail to fight dangerous security exploit

1998-07-31 21:42:18
On 31 July 1998, Bill McClatchie <wmcclatc(_at_)primenet(_dot_)com> wrote:
On Wed, 29 Jul 1998, Geoff Mulligan wrote:

David, You are going to need to use the B flag since the Mime fields
we want to check are embedded in the body of the messages and
therefore you can't use formail to truncate them.  We can either run
the message through sed or nawk or perl or dump these messages into
a holding bin.

This will possible stop the particular buffer overrun but it would
still be possible to overrun other mime fields.  I think that the
best way to fix this is to check the header to see if it is a mime
message and then run the message through a true mime interpreter
that would truncate any huge field values.

It is in the body?  Hadn't checked any of my mime mail to see where
the line was located. :)
[...]

    The MIME headers can occur both in the header and in the body,
although things like filenames are much more common in the body than in
the header.  In fact, the whole body is a special type of attachment.
What you probably want is to take care of both cases.

    Regards,

    Liviu

-- 
Dr. Liviu Daia                   e-mail:   daia(_at_)stoilow(_dot_)imar(_dot_)ro
Institute of Mathematics         web page: http://www.imar.ro/~daia
of the Romanian Academy          PGP key:  finger 
daia(_at_)stoilow(_dot_)imar(_dot_)ro