procmail
[Top] [All Lists]

Re: More quoting issues affecting MIME header exploits

1998-08-01 10:20:44
On Fri, 31 Jul 1998, John D. Hardin wrote:

  Content-Type: ... name="AAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAA
    AAAAAAAAAAAAAAAAAAAA
    ...
    AAAAAAAAAAAAAAAAAAAA
    AAexploit-code-starts-here"

would be syntactically valid but would bypass my filters. I have modified
html-trap.procmail to append a close quote on the first line, but it does
NOT clean up the remaining lines.

Okay, html-trap.procmail will now clean up the extra lines in the above
example.

I couldn't find any explicit list of acceptable MIME headers in reading
through RFC2045, just mention that headers beginning with "Content-" have
meaning to MIME. Therefore I decided to prepend "X-Comment:" to the
continuation lines to clean them up. If anyone knows that this won't work,
drop me a line right away.

See http://www.wolfenet.com/procmail-kit.html for the home page,
ftp://ftp.rubyriver.com/pub/jhardin/antispam/ for the procmail files
themselves. My web account traffic is 'way up since this started, so I'd
prefer if you got the files themselves from the ftp site, which I don't
have to pay for... :)

--
 John Hardin KA7OHZ                               
jhardin(_at_)wolfenet(_dot_)com
 pgpk -a finger://gonzo.wolfenet.com/jhardin    PGP key ID: 0x41EA94F5
 PGP key fingerprint: A3 0C 5B C2 EF 0D 2C E5  E9 BF C8 33 A7 A9 CE 76 
-----------------------------------------------------------------------
  Your mouse has moved. Windows NT must be restarted for the change
  to take effect. Reboot now?  [ OK ]
-----------------------------------------------------------------------
   85 days until Daylight Savings Time ends