Re: Re: Moot choices, a sort of DD media party

[Florian Weimer <fw () deneb enyo de>]

* Aviram Jenik:

> A while ago we found a problem in the SMTP standard ("SMTP fragmentation") 
> that allowed SMTP gateway bypassing in a way similar to TCP fragmentation:
> http://www.securiteam.com/securitynews/5YP0A0K8CM.html
>
> We decided the right thing to do was to contact all the relevant vendors we 
> could find in addition to CERT, and hope for the best. We were actually 
> surprised for the better

Well, the underlying problem has nothing to do with SMTP.  You try to
protect a fragile parser B by sticking some parser A in front of it.
In order to do this, A must have detailed knowledge of a wide variety
of Bs, and in practice, there will always be discrepancies which can
be used to bypass parser A.

This is quite a frequent theme: ZIP archives and CRC mismatches,
malformed Microsoft Office documents with macros, TCP segments with
strange flags, HTTP requests with malformed headers, and so on.  It's
better to assume that security cannot be composed this way.
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
https://lists.immunitysec.com/mailman/listinfo/dailydave