bugphpGroupWare - Bugs: bug #15225, mime boundery vulnerable


You are not allowed to post comments on this tracker with your current authentication level.

bug #15225: mime boundery vulnerable

Submitted by:  Chris Weiss <cw>
Submitted on:  Thu 15 Dec 2005 07:15:46 PM UTC  
Item Group: email
Severity: 3 - NormalPriority: 5 - Normal
Status: NonePrivacy: Public
Assigned to: NoneOpen/Closed: Open
Component Version: NoneOperating System: None
Reproducibility: NonePlanned Release: None
Fixed Release: 

Thu 15 Dec 2005 07:15:46 PM UTC, original submission:

I don't think this is a security risk, it seems to only prevent the forwarding of certain attachements. since it's an escaping issue it still might be a security risk, I'm not good enough with regex to know.

Any email with a boundery containing a / (forward slash) will produce an error. the reason is that the regex used to pull the attachement to the forwarded email uses / as the regex delimiter and it's done in a way that causes preg_replace to think the regex is finished. a sample error is:
Warning: Unknown modifier 'a' in /var/www/phpgroupware/email/inc/class.bosend.inc.php on line 924

for the boundary of "828723761A.1134664025/mail.domain.com"

"/" is valid in a boundary as per http://www.ietf.org/rfc/rfc2046.txt.

I'll post on the mailing list to find the right "fix", for now escaping the / works:
$this_boundary = str_replace('/', '\/', $this_boundary);

Chris Weiss <cw>
Project Administrator


No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.


Please enter the title of George Orwell's famous dystopian book (it's a date):



Follows 1 latest change.

Date Changed By Updated Field Previous Value => Replaced By
Thu 15 Dec 2005 07:15:46 PM UTCcwCarbon-Copy-=>Added -unavailable-

Back to the top

Powered by Savane 3.1-cleanup1