MAILsweeper MIME encapsulation attachment filter bypass
| mailsweeper-mime-encapsulation-bypass (11495) |  Medium Risk |
Description:
MAILsweeper for SMTP creates a malformed MIME encapsulated attachment, the attacker could bypass mail attachment filtering mechanisms and deliver a malicious executable file to the affected system.
Platforms Affected:
- Clearswift, MAILsweeper for SMTP 4.x
Remedy:
Apply the fix, available from the Clearswift Limited Web site. See References.
Consequences:
Bypass Security
References:
- BugTraq Mailing List, Wed Mar 26 2003 - 09:25:42 CST, RE: Corsaire Security Advisory - Clearswift MAILsweeper MIME attachment evasion issue at http://archives.neohapsis.com/archives/bugtraq/2003-03/0391.html.
- Clearswift Limited Web site, Current Patches at http://www.clearswift.com/support/msw/patch.aspx.
- NTBugTraq Mailing List, Fri, 7 Mar 2003 18:54:51 -0000, Corsaire Security Advisory - Clearswift MAILsweeper MIME attachment evasion issue at http://www.ntbugtraq.com/default.asp?pid=36&sid=1&A2=ind0303&L=ntbugtraq&F=P&S=&P=2905.
- BID-7044: Clearswift MailSweeper Malformed MIME Attachment Filter Bypass Vulnerability
- CVE-2003-0121: Clearswift MAILsweeper 4.x allows remote attackers to bypass attachment detection via an attachment that does not specify a MIME-Version header field, which is processed by some mail clients.
Reported:
Mar 07, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net