bugtraq - Re: Dangers of discarding duplicated messages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <58558971.20050218103150@soltysiak.com>
Date: Fri, 18 Feb 2005 10:31:50 +0100
From: Maciej Soltysiak <maciej@...tysiak.com>
To: bugtraq@...urityfocus.com
Subject: Re: Dangers of discarding duplicated messages


Hello Adrian,

Thursday, February 17, 2005, 7:57:01 PM, you wrote:

> It seems to be required that programs that automatically discard
> duplicate messages have to use a checksum over the body and part of the
> header of the emails instead of relying on the message ID.
Very interesting indeed Adrian.
So to sum it all up just for now, the advisories are two.
One for users, one for developers of MUAs.

Users: Beware of the fact that automatic discarding of duplicated messages
       may result in you not getting the original mail in case someone exploits
       the effect Adrian depicted.

Developers: Consider using checksum of the email messages, not only the
            Message-ID to distinguish between duplicated messages.

Am I correct?
            
Fortunately I was never using this MUA feature - I just take care of the
duppies manually, which is not a big chore for me I must say.


-- 
Best regards,
Maciej Soltysiak