bugtraq - Re: Corsaire Security Advisory - Multiple vendor MIME RFC2047 encoding issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0409151448170.6811@shishi.roaringpenguin.com>
Date: Wed, 15 Sep 2004 14:51:06 -0400 (EDT)
From: "David F. Skoll" <dfs@...ringpenguin.com>
To: David Covin <dcovin@....mgh.harvard.edu>
Cc: bugtraq@...urityfocus.com
Subject: Re: Corsaire Security Advisory - Multiple vendor MIME RFC2047 encoding
 issue

On Wed, 15 Sep 2004, David Covin wrote:

> Two points:

> It's fair to argue
> that canonicalizing is the more useful policy, but not that it is the
> only secure one.

Fair enough, with the caveat that it's probably easier to canonicalize
than to detect all MIME messages that might possibly be misinterpreted.

> 2. Your logic sounds convincing, but interposing a proxy that
> systematically changes incoming messages raises red flags in my mind.

Indeed.

> Yours is a more sophisticated approach, but I still see the
> potential for strange interactions between the gateway security
> product's MIME implementation and those of sending and receiving
> programs.  Have you found this to be a problem, for those who've
> been using this filter?

I have run into some problems, which is why the canonicalization is
disabled by default.

Regards,

David.