bugtraq - Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.21.0612070628220.19489-100000@linuxbox.org>
Date: Thu, 7 Dec 2006 06:30:49 -0600 (CST)
From: Gadi Evron <ge@...uxbox.org>
To: Hendrik Weimer <hendrik@...o.de>
Cc: bugtraq@...urityfocus.com, tkojm@...mav.net, info@...persky.com,
	info@...ecure.com
Subject: Re: Multiple Vendor Unusual MIME Encoding Content Filter Bypass

On Wed, 6 Dec 2006, Hendrik Weimer wrote:
> Several e-mail virus scanners can be tricked into passing an EICAR
> test file if the following conditions are met:
> 
> 1. the EICAR file is encoded in Base64 including characters not in the
>    standard alphabet (e.g. whitespaces) and
> 2. the part containing the EICAR file is nested within one or several
>    levels of multipart/mixed content.

Victor Duchovni agreed for me to post what he employs to avoid such
issues. This is in some ways similar to a limited application firewall for
SMTP, which is not spam specific and MIME only. Yes, I know, SMTP
application firewalls are the 4th buzzword down the road, give it a couple 
of years.

Victor's information:

I have a MIME normalizer in front of the A/V engine. Non-conformant
Base64 entities are made conformant or neutered (super-encoded via QP
so that the user receives the base64 text itself as the entity payload).

--------
    In:
            CT: application/octet-stream
            CD: attachment; filename=foo.dat
            CTE: base64

            AA AA

    Out:
            CT: application/octet-stream
            CD: attachment; filename=foo.dat
            CTE: base64

            AAAA
--------
    In:
            CT: application/octet-stream
            CD: attachment; filename=foo.dat
            CTE: base64

            AA<Ctrl-A>AA

    Out:
            CT: text/plain
            CD: attachment; filename=mime-source.txt
            CTE: quoted-printable

            =20AA=01AA
--------

Solves all such problems before the vulnerability is found in the
A/V engine.

The MIME normalizer does more, defending other possible
bypass scenarios, but I not able to describe the full feature-set
at this time. It was written and deployeed in Dec 1999.
--- End quote.

All the above is Viktor's.

	Gadi Evron.