From SmartD at VMCMAIL.com Fri Jul 2 08:43:47 2004 From: SmartD at VMCMAIL.com (Smart,Dan) Date: Mon Dec 26 10:18:45 2005 Subject: [Esd-l] Updated Sanitizer functionality list Message-ID: <8E68F5A27FC613458BF7A9881D959D07DA2897@cobhm006.na.vul.com> Here's my updated functionality list for Sarbanes-Oxley Documentation... John Hardin's Sanitizer functionality. HEADERS 1. Sanitize bare CR in message headers (Outlook bug). That's also in violation of RFC822 so it's a protocol sanitizing issue. 2. Sanitize multiple null addresses (sendmail exploit). ^((resent-)?(sender|from|(reply-)?to|cc|bcc)|(errors|disposition-notificatio n|apparently)-to|Return-Path): *<>.*<>.*<>.*<>.*<>.*<>.* 3. Detect and truncate Subject: headers longer then 250 characters, to protect Outlook Express users. 4. Truncate excessively long (>500) standard headers, to address the MS Outlook header buffer-overflow bug and to proactively protect against other BO bugs in other mailers; (Mime-Version|(Resent-)?(Date|Sender|From|Reply-To)|(errors|disposition-noti fication|apparently)-to|Message-ID|Return-Path|Status|X-Status|X-Keywords): FIX MIME 1. Length-limit MIME boundary strings, to proactively defend against BO bugs. 2. Check for a null MIME boundary string and supply one if necessary; this is a major DoS attack against Microsoft Exchange 3. Sanitize MIME values that have been explicitly set to null (e.g. encoding="") - this is a major DoS attack against Microsoft Exchange. 4. Sanitize double backquotes in MIME headers to prevent remote attacks against Metamail via the UW Pine MUA ATTACHMENT HEADERS 1. Sanitize files with Microsoft Class-ID extensions. 2. Shorten long file names to less than 120 characters a. Collapse runs of spaces in filenames before length-limiting. 3. Truncate long attachment headers (vs. RFC822 message headers as you noted), again to proactively defend against BO bugs in mailers. 4. Fix missing closed quote on filename 5. Fix unquoted filenames a. Properly enquote unquoted attachment filenames that have embedded semicolons. 6. Fix trailing periods and spaces in filename. 7. Catch encoded periods in filenames and fix encoded plain characters in filename. Both because there's no reason to encode those characters other than an attempt to bypass filtering. 8. Catch quotes-in-extension attack. Outlook/Windows ignores them. (!) 9. Remove embedded RFC822 comments 10. Fix attachment headers of the form 'text from file "xxxx"' where Outlook helpfully looks if the filename can't be determined from the headers that *should* have the filename. URLs 1. Fix URL Spoofing; a.com%01@b.com 2. Fix URL Obfuscation; a.com@b.com There's no good reason to encode plain characters other than an attempt to bypass filtering. WEBBUGS 1. Sanitize tags 2. Sanitize webbug images in tables. 3. Sanitize the tag for webbugs 4. Santize "BACKGROUND" subtag for webbugs TAGS 1. Sanitize the tag. 2. Sanitize the tag; this is primarily of interest to people running webmail programs. 3. Sanitize