Project

General

Profile

Actions

Feature #4386

closed

Support for RFC2231

Added by Gatewatcher Dev Team about 3 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:
C, Protocol

Description

We noticed a lack of support for multiline header attributes in mime documents as defined in RFC2231 (standard track).
This RFC documents a way to split header attributes across multiple lines, so that the line length remains short.
This wrapping is implemented by some popular MUA, including Thunderbird. Lack of support for this RFC results in Suricata not noticing/storing email attachments with filenames wrapped that way (filename*0=, filename*1=...).
This can also be considered as a evasion technique, although this is a standard track RFC.

We attached a pcap file containing an email attachment ignored by Suricata.

Thank you,

Cheers,
Florian Maury


Files

exemple_mime_sans_name_rfc.pcap (82.3 KB) exemple_mime_sans_name_rfc.pcap Gatewatcher Dev Team, 03/09/2021 09:17 AM

Subtasks 1 (0 open1 closed)

Feature #5478: Support for RFC2231 (6.0.x backport)ClosedPhilippe AntoineActions
Actions #1

Updated by Philippe Antoine almost 3 years ago

  • Status changed from New to In Review
  • Target version set to 7.0.0-beta1
Actions #2

Updated by Victor Julien over 2 years ago

  • Assignee set to Philippe Antoine
Actions #3

Updated by Philippe Antoine over 2 years ago

  • Status changed from In Review to Closed
Actions #4

Updated by Victor Julien over 1 year ago

  • Status changed from Closed to Resolved
  • Label Needs backport to 6.0 added
Actions #5

Updated by Philippe Antoine over 1 year ago

  • Subtask #5478 added
Actions #6

Updated by Victor Julien over 1 year ago

  • Label deleted (Needs backport to 6.0)
Actions #7

Updated by Philippe Antoine over 1 year ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF