Project

General

Profile

Actions

Feature #4386

open

Support for RFC2231

Added by Armature Technologies 7 months ago. Updated 12 days ago.

Status:
In Review
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:
C, Protocol

Description

We noticed a lack of support for multiline header attributes in mime documents as defined in RFC2231 (standard track).
This RFC documents a way to split header attributes across multiple lines, so that the line length remains short.
This wrapping is implemented by some popular MUA, including Thunderbird. Lack of support for this RFC results in Suricata not noticing/storing email attachments with filenames wrapped that way (filename*0=, filename*1=...).
This can also be considered as a evasion technique, although this is a standard track RFC.

We attached a pcap file containing an email attachment ignored by Suricata.

Thank you,

Cheers,
Florian Maury


Files

exemple_mime_sans_name_rfc.pcap (82.3 KB) exemple_mime_sans_name_rfc.pcap Armature Technologies, 03/09/2021 09:17 AM
Actions #1

Updated by Philippe Antoine 4 months ago

  • Status changed from New to In Review
  • Target version set to 7.0rc1
Actions #2

Updated by Victor Julien 12 days ago

  • Assignee set to Philippe Antoine
Actions

Also available in: Atom PDF