Correction to latest Colsaire advisories

[3APA3A]

Just to keep correctness.

Colsaire could provide better service to it's customers by better
researching available information on researched topic.

Most of reported content filtering bypassing techniques are already
known and described in [1] with credentials believed to be valid.

MIME RFC2231 encoding issue - David F. Skoll
MIME RFC2047 encoding issue - different authors (different problems were
discovered, information from Colsaire advisory is not enough).
Content-Transfer-Encoding mechanism issue - different authors
MIME field multiple occurrence issue - 3APA3A
MIME separator issue - 3APA3A
MIME field whitespace issue - 3APA3A
MIME RFC822 comment issue (at least partially) - 3APA3A

There is also a _lot_ of different bypass techniques Colsaire failed to
discover.


[1] 3APA3A, Bypassing content filtering whitepaper
http://www.security.nnov.ru/advisories/content.asp

--
http://www.security.nnov.ru
/\_/\
{ , . } |\
+--oQQo->{ ^ }<-----+ \
| ZARAZA U 3APA3A } You know my name - look up my number (The Beatles)
+-------------o66o--+ /
|/

[Andreas Marx]

Hello!

> Just to keep correctness.

.... and 3APA3A was not the only one who has discovered a high number of
vulnerabilities.


In 2002 we have started the so-called "Malformed Mail Project". You can
find more information about this project at this website (look for "Virus
Bulletin" papers):
<http://www.av-test.org/sites/references_papers.php3?lang=en>


*** Malformed Email Project, Virus Bulletin 11/2002
<http://www.virusbtn.com/magazine/archives/200211/malformed.xml>

-> This paper includes a short description of the project we've started
back in 04/2002. Mark Ackermans has created a testset which contains 370
different malformed mails which several anti-virus and content scanner
products were not able to handle properly. (At the moment, we have more
than 400 different ones in our testset, only about 10% of them are publicly
known yet!)

NOTE: If you are a security company and do not have access to the testset
yet, you can request a copy (at no charge). You can find more details in
the article above (don't forget to read the NDA section included). Please
use the mail addresses which are mentioned at <http://www.av-test.org> in
the "About us" section only, do not reply to this address!


*** Malformed Email Project - Part 2, Virus Bulletin 02/2003
<http://www.av-test.org/sites/references_papers.php3?lang=en>

-> This paper includes the reactions (e.g. released updates and
work-arounds) from the notified companies. An incomplete list can be found
below (read the article for more details):

Amavis - A Mail Virus Scanner
Astaro, Astaro Security
Beginfinite, GWAVA for GroupWise
Borderware, Mail Gateway/Mxtreme Firewall
Cat Computer Systems, Quickheal
Clearswift, Mimesweeper
Command Software, Command AV
Computer Associates, InoculateIT/eTrust AV
Computerized Horizons, Declude Virus
DataEnter, XWall
Finjan, Surfin Gate
Fortinet, Fortigate
F-Secure, F-Secure Anti-Virus
G Data, AntiVirenKit
Gecad Software, Reliable AV
GFI, MailSecurity/Mail essentials
Gordano, Messaging Suite
Grisoft, AVG
Group Technologies, IQ Suite
H+BEDV Datentechnik, AntiVir Mailgate
IBM, Lotus Notes/Domino
Ikarus Software, Virus Utilities
Indefense, Maildefense
Kaspersky Labs, Kaspersky AV
Marshal Software, MailMarshal
MessageLabs, SkyScan AV
Microsoft, Exchange Server/ISA Server
Microworld Technologies, eScan/Mailscan
Mirapoint, Secure Messaging
MKS, MKS_VIR
Network Associates, Virusscan/Groupshield/Netshield etc.
Norman, Virus Control
Open Access, MailGate
Panda Software, Panda AV
Postini, Postini
Softwin, Bitdefender
Sonicwall, SonicWall
Sophos, Mail Monitor
Stalker, CommuniGate Pro
Surfcontrol, Surfcontrol e-mail filter
Sybari, Antigen
Symantec, Norton AV/Symantec AV
Trend Micro, InterScan/ScanMail etc.
Vircom, VOP ModusGate/ModusMail
VirusBuster, VirusBuster
WatchGuard Technologies, WatchGuard
Webwasher, Webwasher
ZoneLabs, ZoneAlarm


cheers,
Andreas Marx

--
AV-Test GmbH, Klewitzstr. 7, 39112 Magdeburg, Germany
Phone: +49 (0)391 6075466, <http://www.av-test.org>

[advisories]

> I presume that these are nine of the
> "top 10 content providers".

Actually, no. Our internal testing covered a limited collection of what we
considered the most prevalent enterprise products. When it became clear that
the issues were widespread, we brought NISCC in to coordinate passing out a
set of canned test tools to all the MIME related vendors they could find
(anecdotally, I think this was something like 100+).

We obviously have the results of our own testing (which is where the stats
come from), but the other vendors have been invited to make their own
declaration as to the outcome of the test tools. Needless to say the
statements provided so far are somewhat sparse; the only vendor from our
original test set to make a statement is F-Secure.

> I also note that Microsoft was not listed as a vendor that responded.
> Were their products tested and if so what were the results?

Yes, they were tested. Yes, they have chosen not to make a public statement.
I personally don't know why this may be so. Perhaps you could ask them? ;)

The release model for these vulnerabilities has been the best compromise of
what is a difficult situation. Releasing as individual advisories (or
per-product clumps) was never going to be ideal; both because of the volume
and because earlier public releases expose information about products that
come later in the process. The solution chosen was to pick a date far-off in
the future, to provide the vendors with all the information they needed to
replicate the issues, and then to allow them to make their own public
statements as to compliance. Effectively the same model as the SNMP issues
from a few years ago.

History may prove this not to be ideal, and a better model may be needed.

Regards,
Martin O'Neal

[David Litchfield]

>The Corsaire research project produced test cases for around 200 working
>attack vectors, that when passed through the top 10 content products
>produced over 800 individual vulnerabilities (needless to point out that
>there are a lot more than 10 products in this arena).

Not wanting to quibble, but looking for clarification:

The associated UNIRAS advisory
(http://www.uniras.gov.uk/vuls/2004/380375/mime.htm) lists the responses
from various vendors with regards to these issues. I presume that these are
nine of the "top 10 content providers". Vendors include:

Apple, F-Secure, Fujitsu, HP, IBM, MessageLabs, Mozilla and ripMIME.

Only ripMIME and F-Secure (Server products affected, workstation products
fine) claim to have been found wanting. The remainder clearly state that
their products, when put through the test suite, were _not_ found to be
vulnerable.

How does this translate to the figures you're talking about? I ask this to
better understand the risk. Is this something everything else should be
dropped for and this prioritized? From the UNIRAS advisory I'd assume not,
unless of course you use F-secure servers or ripMIME, and, at the moment, it
all seems a bit like a storm in a teacup.

I also note that Microsoft was not listed as a vendor that responded. Were
their products tested and if so what were the results?

Cheers,
David Litchfield
NGSSoftware Ltd
http://www.nextgenss.com/
http://www.databasesecurity.com/
+44(0)1334 470 027

[advisories]

# This has been re-sent several times in the last week, but for whatever
reason, my email hasn't been getting to the bugtraq list.

> I presume that these are nine of the
> "top 10 content providers".

Actually, no. Our internal testing covered a limited collection of what we
considered the most prevalent enterprise products. When it became clear that
the issues were widespread, we brought NISCC in to coordinate passing out a
set of canned test tools to all the MIME related vendors they could find
(anecdotally, I think this was something like 100+).

We obviously have the results of our own testing (which is where the stats
come from), but the other vendors have been invited to make their own
declaration as to the outcome of the test tools. Needless to say the
statements provided so far are somewhat sparse; the only vendor from our
original test set to make a statement is F-Secure.

> I also note that Microsoft was not listed as a vendor that responded.
> Were their products tested and if so what were the results?

Yes, they were tested. Yes, they have chosen not to make a public statement.
I personally don't know why this may be so. Perhaps you could ask them? ;)

The release model for these vulnerabilities has been the best compromise of
what is a difficult situation. Releasing as individual advisories (or
per-product clumps) was never going to be ideal; both because of the volume
and because earlier public releases expose information about products that
come later in the process. The solution chosen was to pick a date far-off in
the future, to provide the vendors with all the information they needed to
replicate the issues, and then to allow them to make their own public
statements as to compliance. Effectively the same model as the SNMP issues
from a few years ago.

History may prove this not to be ideal, and a better model may be needed.

Regards,
Martin O'Neal