phpGroupWare - Bugs: bug #15225, mime boundery vulnerable
You are not allowed to post comments on this tracker with your current authentication level.
bug #15225: mime boundery vulnerable
Submitter: | Chris Weiss <cw> | ||
Submitted: | Thu 15 Dec 2005 07:15:46 PM UTC | ||
Item Group: | 0.9.16.009 | Category: | |
Severity: | 3 - Normal | Priority: | 5 - Normal |
Status: | None | Privacy: | Public |
Assigned to: | None | Open/Closed: | Open |
Component Version: | None | Operating System: | None |
Reproducibility: | None | Planned Release: | None |
Fixed Release: |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
CC list is empty
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follows 1 latest change.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2005-12-15 | cw | Carbon-Copy | - | ![]() |
Added -email is unavailable- |
I don't think this is a security risk, it seems to only prevent the forwarding of certain attachements. since it's an escaping issue it still might be a security risk, I'm not good enough with regex to know.
Any email with a boundery containing a / (forward slash) will produce an error. the reason is that the regex used to pull the attachement to the forwarded email uses / as the regex delimiter and it's done in a way that causes preg_replace to think the regex is finished. a sample error is:
Warning: Unknown modifier 'a' in /var/www/phpgroupware/email/inc/class.bosend.inc.php on line 924
for the boundary of "828723761A.1134664025/mail.domain.com"
"/" is valid in a boundary as per http://www.ietf.org/rfc/rfc2046.txt.
I'll post on the mailing list to find the right "fix", for now escaping the / works:
$this_boundary = str_replace('/', '\/', $this_boundary);