[NEWS] Clearswift MAILsweeper MIME Attachment Evasion Issue

From: support@securiteam.com
Date: 03/09/03

  • Next message: support@securiteam.com: "[EXPL] Win32hlp Exploit for : ":LINK overflow"" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 9 Mar 2003 15:41:27 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    In the US?

    Contact Beyond Security at our new California office
    housewarming rates on automated network vulnerability
    scanning. We also welcome ISPs and other resellers!

    Please contact us at: 323-882-8286 or ussales@beyondsecurity.com
    - - - - - - - - -

      Clearswift MAILsweeper MIME Attachment Evasion Issue
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.mimesweeper.com/products/msw/default.asp> MIMEsweeper is a
    family of products designed to implement email and web communications
    e-policies. MIMEsweeper delivers the capabilities for organizations to
    protect themselves against email and web based threats, meet legal and
    regulatory requirements, implement productivity saving policies and manage
    the intellectual property passing through their network.

    A vulnerability in the product allows attackers to use a technique that
    would allow them to pass through MAILsweeper undetected. This is done by
    using malformed MIME encapsulation techniques.

    DETAILS

    Vulnerable systems:
     * Clearswift MAILsweeper version 4.x

    The attachment detection functionality works by recursively analyzing the
    email message body and attachments for container constructs (such as
    MIME), decoding these, and then comparing the contents against a
    predefined policy.

    If a deliberately malformed MIME encapsulation technique is used, then the
    MAILsweeper product will not recognize the attachment and allows it to
    pass unhindered.

    However, not all client applications require strict standards compliance
    and some will happily accept and process the malformed attachment.

    Proof of concept:
    For this proof of concept, the MIME encapsulation is simply modified to
    remove the MIME-Version header field. An example of an application that
    will process a MIME construct that is malformed in this way is Microsoft
    Internet Explorer.

    Whilst RFC2045 states that all agents must include this field [2] it then
    goes on to say that "In the absence of a MIME-Version field, a receiving
    mail user agent (whether conforming to MIME requirements or not) may
    optionally choose to interpret the body of the message according to local
    conventions."

    Step 1: On the MAILsweeper host, create a new Data Type Manager with only
    the Executable type selected. Save and restart the MAILsweeper Security
    service.

    Step 2: Now create a text file that will be used to hold the MIME encoded
    attachment. Start notepad (or another text editor), and paste in:

         MIME-Version: 1.0
         Content-Location:file:///executable.exe
         Content-Transfer-Encoding: base64

         TVp0AQIAAAAgAAgA//8YAIAAAAAQAAIAHgAAAAEAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAC4AQCO2I0WAgC0Cc0huCBMzSFFeGUhJCQJALH/
         /////wAAAAAAAFQBAAAAAAIAUkKL6IzABRAADh+jBAADB
         gwAjsCLDgYAi/lPi/f986RQuDQAUMuMw4zYSI7YjsC/Dw
         C5EACw//OuR4v3i8NIjsC/DwCxBIvG99DT6IzaK9BzBIz
         YK9LT4APwjtqLx/fQ0+iMwivQcwSMwCvS0+AD+I7CrIrQ
         Tq2LyEaKwiT+PLB1BazzqusGPLJ1bfOkisKoAXSxvjIBD
         h+LHgQA/DPSrYvI4xOLwgPDjsCti/iD//90ESYBHeLzgf
         oA8HQWgcIAEOvcjMBAjsCD7xAmAR1IjsDr4ovDiz4IAIs
         2CgAD8AEGAgAtEACO2I7AuwAA+o7Wi+f7i8Uu/y+0QLsC
         ALkWAIzKjtq6HAHNIbj/TM0hUGFja2VkIGZpbGUgaXMgY
         29ycnVwdAEAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
         AAAAAAAAA=

    Step 3: To reproduce this issue, send an email containing the attachment
    created in step 2 that will be processed by the scenario from step 1. This
    should result in a successful discovery condition.

    Step 4: Reopen the attachment from step 2 and remove the first line
    (MIME-Version: 1.0), then resend the attachment as per step 3. This should
    result in the attachment not being spotted as an executable.

    Recommendations:
    To be an effective tool, the MAILsweeper product must not only be able to
    process encoding techniques implemented as per the relevant standard, but
    also common misinterpretations.

    As an ongoing process, a study project should be undertaken by Clearswift
    to identify applications that routinely decode MIME objects and have a
    liberal interpretation of the MIME standard.

    In response to this advisory, Clearswift have produced an updated script
    utility that can detect the malformed MIME header used in this example
    [3]. This should be implemented until a more permanent solution is
    forthcoming.

    ADDITIONAL INFORMATION

    References:
    [1] <http://www.clearswift.com> http://www.clearswift.com

    [2] <http://www.rfc.net/rfc2045.html#s4>
    http://www.rfc.net/rfc2045.html#s4

    [3] <http://www.clearswift.com/support/threatlab/vbstool.asp>
    http://www.clearswift.com/support/threatlab/vbstool.asp

    The information has been provided by <mailto:bugtraq@corsaire.com> Martin
    O'Neal.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: support@securiteam.com: "[EXPL] Win32hlp Exploit for : ":LINK overflow""

    Relevant Pages