Project

General

Profile

Actions

Feature #4386

open

Support for RFC2231

Added by Gatewatcher Dev Team over 1 year ago. Updated 14 days ago.

Status:
Resolved
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:
C, Needs backport to 6.0, Protocol

Description

We noticed a lack of support for multiline header attributes in mime documents as defined in RFC2231 (standard track).
This RFC documents a way to split header attributes across multiple lines, so that the line length remains short.
This wrapping is implemented by some popular MUA, including Thunderbird. Lack of support for this RFC results in Suricata not noticing/storing email attachments with filenames wrapped that way (filename*0=, filename*1=...).
This can also be considered as a evasion technique, although this is a standard track RFC.

We attached a pcap file containing an email attachment ignored by Suricata.

Thank you,

Cheers,
Florian Maury


Files

exemple_mime_sans_name_rfc.pcap (82.3 KB) exemple_mime_sans_name_rfc.pcap Gatewatcher Dev Team, 03/09/2021 09:17 AM

Subtasks 1 (1 open0 closed)

Feature #5478: Support for RFC2231 - backport 6.0.xIn ReviewPhilippe AntoineActions
Actions #1

Updated by Philippe Antoine about 1 year ago

  • Status changed from New to In Review
  • Target version set to 7.0rc1
Actions #2

Updated by Victor Julien 11 months ago

  • Assignee set to Philippe Antoine
Actions #3

Updated by Philippe Antoine 8 months ago

  • Status changed from In Review to Closed
Actions #4

Updated by Victor Julien 18 days ago

  • Status changed from Closed to Resolved
  • Label Needs backport to 6.0 added
Actions #5

Updated by Philippe Antoine 14 days ago

  • Subtask #5478 added
Actions

Also available in: Atom PDF