bugphpGroupWare - Bugs: bug #15225, mime boundery vulnerable


You are not allowed to post comments on this tracker with your current authentication level.

bug #15225: mime boundery vulnerable

Submitter:  Chris Weiss <cw>
Submitted:  Thu 15 Dec 2005 07:15:46 PM UTC
Category:  email Item Group:
Severity:  3 - Normal Priority:  5 - Normal
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
Component Version:  None Operating System:  None
Reproducibility:  None Planned Release:  None
Fixed Release: 

Thu 15 Dec 2005 07:15:46 PM UTC, original submission:  

I don't think this is a security risk, it seems to only prevent the forwarding of certain attachements.  since it's an escaping issue it still might be a security risk, I'm not good enough with regex to know.

Any email with a boundery containing a / (forward slash) will produce an error.  the reason is that the regex used to pull the attachement to the forwarded email uses / as the regex delimiter and it's done in a way that causes preg_replace to think the regex is finished.  a sample error is:
 Warning: Unknown modifier 'a' in /var/www/phpgroupware/email/inc/class.bosend.inc.php on line 924

for the boundary of "828723761A.1134664025/mail.domain.com"

"/" is valid in a boundary as per http://www.ietf.org/rfc/rfc2046.txt.

I'll post on the mailing list to find the right "fix", for now escaping the / works:
$this_boundary = str_replace('/', '\/', $this_boundary);

Chris Weiss <cw>
Group administrator


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.


Follows 1 latest change.

Date Changed by Updated Field Previous Value => Replaced by
2005-12-15 cw Carbon-Copy- Added -email is unavailable-

Back to the top

Powered by Savane 3.13-c54d.
Corresponding source code