[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120512171943.GA1018@openwall.com>
Date: Sat, 12 May 2012 21:19:43 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: micah anderson <micah@...eup.net>
Subject: Re: ezmlm signature mangling [was: Re: CVE request: sympa (try again)]
On Sat, May 12, 2012 at 01:44:19AM -0400, Daniel Kahn Gillmor wrote:
> On 05/11/2012 02:03 PM, micah wrote:
> > ps - for some reason the previous message is formatted strange, so I'm
> > sending this one without the signature
>
> Comparing the received version of the message with its original source,
> it appears that the mailing list software (ezmlm?) mangled Micah's
> message by modifying the internal mime parts of the message, despite
> them being wrapped inside a multipart/signed block. This contravenes
> the relevant standards [0], which indicate that the data within a
> multipart/signed MIME part needs to be treated by any MTA as opaque.
>
> I don't know who updates ezmlm these days, but that probably needs to be
> addressed if there's an expectation that people should be able to send
> cryptographically-signed messages with non-ASCII text to the list.
>
> --dkg
>
> [0] https://tools.ietf.org/html/rfc3156#section-3
Thank you for looking into this issue. I also briefly looked into it
yesterday. My guess is that the issue might have been triggered by the
rather unusual MIME section boundary strings ("=-=-="). Maybe these are
specific to Notmuch. We had other signed messages in here, which got
through to the list just fine. For just one affected message in 7658
(total on this list so far), I think I am not going to bother to
investigate this further and patch it.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
