You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2013/03/25 09:07:23 UTC
[Bug 6921] New: 'MimeHeader' plugin does not decode mime headers
encoded as per RFC 2047
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6921
Bug ID: 6921
Summary: 'MimeHeader' plugin does not decode mime headers
encoded as per RFC 2047
Product: Spamassassin
Version: 3.3.1
Hardware: All
OS: All
Status: NEW
Severity: major
Priority: P2
Component: Plugins
Assignee: dev@spamassassin.apache.org
Reporter: ashish.sharma3@hp.com
Classification: Unclassified
Refering to ' http://en.wikipedia.org/wiki/MIME' section 'Encoded-Word'
>>Content-Type: text/plain; charset=UTF-8;
>>name="=?UTF-8?B?PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0PnRlcy50eHQ=?="
>>Content-Transfer-Encoding: 7bit
>>Content-Disposition: attachment;
>> filename="=?UTF-8?B?PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0PnRlcy50eHQ=?="
Sample *.eml is attached.
Here I have encoded the harmful filename '<script>alert(1)</script>tes.txt' to
base64 and added them into the email as it's allowed as per RFC 2047 in email
headers and is a valid form.
This is bypassing the spam rule that I am using as follows:
>>describe SCRIPTED_NAME Attachment name or filename is a script
>>mimeheader __SCRIPTN1 Content-Type =~ /name.*\=.*<script>/
>>mimeheader __SCRIPTN2 Content-Disposition =~ /filename.*\=.*<script>/
>>meta SCRIPTED_NAME (__SCRIPTN1 || __SCRIPTN2)
>>score SCRIPTED_NAME 6.0
'mimeheader' should decode all the suported mime email header formats including
RFC 2047.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 6921] 'MimeHeader' plugin does not decode mime headers encoded
as per RFC 2047
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6921
--- Comment #2 from Steve Freegard <st...@stevefreegard.com> ---
Ok - Just tried it by modifying an existing message with an attachment and it
works for me on SpamAssassin 3.3.3:
Content analysis details: (11.5 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.6 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT
[80.241.32.110 listed in bb.barracudacentral.org]
0.0 FSL_ABUSED_WEB_1 Has X-AntiAbuse header
1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 FSL_TEST BODY: FSL_TEST
1.5 TVD_PH_BODY_ACCOUNTS_PRE TVD_PH_BODY_ACCOUNTS_PRE
6.0 SCRIPTED_NAME Attachment name or filename is a script
0.0 T_REMOTE_IMAGE Message contains an external image
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 6921] 'MimeHeader' plugin does not decode mime headers encoded
as per RFC 2047
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6921
Ashish Sharma <as...@hp.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |ashish.sharma3@hp.com
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 6921] 'MimeHeader' plugin does not decode mime headers encoded
as per RFC 2047
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6921
Ashish Sharma <as...@hp.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #5140|0 |1
is obsolete| |
--- Comment #4 from Ashish Sharma <as...@hp.com> ---
Created attachment 5141
--> https://issues.apache.org/SpamAssassin/attachment.cgi?id=5141&action=edit
Email containg attachment filename as executable javascript.
Updated attachment
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 6921] 'MimeHeader' plugin does not decode mime headers encoded
as per RFC 2047
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6921
--- Comment #6 from Ashish Sharma <as...@hp.com> ---
you are right Steve, Admin of my Spamassassin was adding rules in wrong file.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 6921] 'MimeHeader' plugin does not decode mime headers encoded
as per RFC 2047
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6921
Ashish Sharma <as...@hp.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |INVALID
--- Comment #7 from Ashish Sharma <as...@hp.com> ---
working fine.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 6921] 'MimeHeader' plugin does not decode mime headers encoded
as per RFC 2047
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6921
--- Comment #5 from Steve Freegard <st...@stevefreegard.com> ---
Works for me with the corrected attachment:
Content preview: Hello Script -- Thanks & Regards, aaa [...]
Content analysis details: (8.2 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 NO_RELAYS Informational: message was not relayed via SMTP
0.0 HTML_MESSAGE BODY: HTML included in message
1.0 FSL_TEST BODY: FSL_TEST
0.0 MISSING_MIME_HB_SEP BODY: Missing blank line between MIME header and
body
-0.0 NO_RECEIVED Informational: message has no Received headers
6.0 SCRIPTED_NAME Attachment name or filename is a script
1.2 INVALID_MSGID Message-Id is not valid, according to RFC 2822
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 6921] 'MimeHeader' plugin does not decode mime headers encoded
as per RFC 2047
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6921
Steve Freegard <st...@stevefreegard.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |steve@stevefreegard.com
--- Comment #1 from Steve Freegard <st...@stevefreegard.com> ---
Looks like you forgot the attachment?
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 6921] 'MimeHeader' plugin does not decode mime headers encoded
as per RFC 2047
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6921
--- Comment #3 from Ashish Sharma <as...@hp.com> ---
Created attachment 5140
--> https://issues.apache.org/SpamAssassin/attachment.cgi?id=5140&action=edit
Email containg attachment filename as executable javascript.
--
You are receiving this mail because:
You are the assignee for the bug.