[NEWS] Clearswift MAILsweeper MIME Attachment Evasion Issue
From: email@example.com To: firstname.lastname@example.org Date: 9 Mar 2003 15:41:27 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
In the US?
Contact Beyond Security at our new California office
housewarming rates on automated network vulnerability
scanning. We also welcome ISPs and other resellers!
Please contact us at: 323-882-8286 or email@example.com
- - - - - - - - -
Clearswift MAILsweeper MIME Attachment Evasion Issue
<http://www.mimesweeper.com/products/msw/default.asp> MIMEsweeper is a
family of products designed to implement email and web communications
e-policies. MIMEsweeper delivers the capabilities for organizations to
protect themselves against email and web based threats, meet legal and
regulatory requirements, implement productivity saving policies and manage
the intellectual property passing through their network.
A vulnerability in the product allows attackers to use a technique that
would allow them to pass through MAILsweeper undetected. This is done by
using malformed MIME encapsulation techniques.
* Clearswift MAILsweeper version 4.x
The attachment detection functionality works by recursively analyzing the
email message body and attachments for container constructs (such as
MIME), decoding these, and then comparing the contents against a
If a deliberately malformed MIME encapsulation technique is used, then the
MAILsweeper product will not recognize the attachment and allows it to
However, not all client applications require strict standards compliance
and some will happily accept and process the malformed attachment.
Proof of concept:
For this proof of concept, the MIME encapsulation is simply modified to
remove the MIME-Version header field. An example of an application that
will process a MIME construct that is malformed in this way is Microsoft
Whilst RFC2045 states that all agents must include this field  it then
goes on to say that "In the absence of a MIME-Version field, a receiving
mail user agent (whether conforming to MIME requirements or not) may
optionally choose to interpret the body of the message according to local
Step 1: On the MAILsweeper host, create a new Data Type Manager with only
the Executable type selected. Save and restart the MAILsweeper Security
Step 2: Now create a text file that will be used to hold the MIME encoded
attachment. Start notepad (or another text editor), and paste in:
Step 3: To reproduce this issue, send an email containing the attachment
created in step 2 that will be processed by the scenario from step 1. This
should result in a successful discovery condition.
Step 4: Reopen the attachment from step 2 and remove the first line
(MIME-Version: 1.0), then resend the attachment as per step 3. This should
result in the attachment not being spotted as an executable.
To be an effective tool, the MAILsweeper product must not only be able to
process encoding techniques implemented as per the relevant standard, but
also common misinterpretations.
As an ongoing process, a study project should be undertaken by Clearswift
to identify applications that routinely decode MIME objects and have a
liberal interpretation of the MIME standard.
In response to this advisory, Clearswift have produced an updated script
utility that can detect the malformed MIME header used in this example
. This should be implemented until a more permanent solution is
The information has been provided by <mailto:firstname.lastname@example.org> Martin
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: email@example.com
In order to subscribe to the mailing list, simply forward this email to: firstname.lastname@example.org
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.