Re: Dangers of discarding duplicated messages

From: Maciej Soltysiak (maciej_at_soltysiak.com)
Date: 02/18/05

  • Next message: Jason Frisvold: "BizMail 2.1 Spam Exploit"
    Date: Fri, 18 Feb 2005 10:31:50 +0100
    To: bugtraq@securityfocus.com
    
    

    Hello Adrian,

    Thursday, February 17, 2005, 7:57:01 PM, you wrote:

    > It seems to be required that programs that automatically discard
    > duplicate messages have to use a checksum over the body and part of the
    > header of the emails instead of relying on the message ID.
    Very interesting indeed Adrian.
    So to sum it all up just for now, the advisories are two.
    One for users, one for developers of MUAs.

    Users: Beware of the fact that automatic discarding of duplicated messages
           may result in you not getting the original mail in case someone exploits
           the effect Adrian depicted.

    Developers: Consider using checksum of the email messages, not only the
                Message-ID to distinguish between duplicated messages.

    Am I correct?
                
    Fortunately I was never using this MUA feature - I just take care of the
    duppies manually, which is not a big chore for me I must say.

    -- 
    Best regards,
    Maciej Soltysiak
    

  • Next message: Jason Frisvold: "BizMail 2.1 Spam Exploit"

    Relevant Pages

    • Re: ccing
      ... > I agree that it's irritating to get duplicate messages. ... > checks emails before sending this can be avoided. ... when the recipient's mail client ignores that instruction. ...
      (Debian-User)
    • Re: ccing
      ... Cheryl Homiak wrote: ... > I agree that it's irritating to get duplicate messages. ... certainly if everybody checks emails before ...
      (Debian-User)
    • ccing
      ... I agree that it's irritating to get duplicate messages. ... At least in Pine, I often ... certainly if everybody checks emails before sending this can be avoided. ...
      (Debian-User)