Project

General

Profile

Actions

Bug #5185

closed

MIME URL extraction missing.

Added by chen dy almost 3 years ago. Updated 6 months ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
C

Description

MIME URL extraction missing when the body like this.
@From: testa <>
To: testb <>
Message-ID: <>
Subject: nnnnn
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: base64

IDxkaXY+IDxkaXY+IDxkaXY+IDxkaXY+PGRpdj5odHRwOi8vY29kYXNob3AtZnJlZTAxLmR1Y2tk
bnMub3JnLzwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXYgaWQ9InNpZ24iPjxkaXYgY2xhc3M9Im0t
YWNjb3VudCI+NTU1NTU1NTU1NTU1NTU1PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+PC9k
aXY+

.@


Related issues 1 (1 open0 closed)

Related to Suricata - Feature #3260: SMTP Base64 Decoding of Message BodyNewOISF DevActions
Actions #1

Updated by Eric Leblond almost 3 years ago

  • Assignee deleted (Eric Leblond)
Actions #2

Updated by chen dy almost 3 years ago

chen dy wrote:

MIME URL extraction missing when the body like this.
From: testa <>
To: testb <>
Message-ID: <>
Subject: nnnnn
Content-Type: text/html;
charset="utf-8"
Content-Transfer-Encoding: base64

IDxkaXY+IDxkaXY+IDxkaXY+IDxkaXY+PGRpdj5odHRwOi8vY29kYXNob3AtZnJlZTAxLmR1Y2tk
bnMub3JnLzwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXYgaWQ9InNpZ24iPjxkaXYgY2xhc3M9Im0t
YWNjb3VudCI+NTU1NTU1NTU1NTU1NTU1PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+PC9k
aXY+

.

The result of Base64 decoding is " <div> <div> <div> <div><div>http://codashop-free01.duckdns.org/&lt;/div&gt;&lt;div&gt;&lt;br&gt;&lt;/div&gt;&lt;div id="sign"><div class="m-account">555555555555555</div></div></div></div></div></div>", which doesn't end with CR/LF.
I found there are following comment in src/util-decode-mime.c ProcessDecodedDataChunk function:
“If last token found without CR/LF delimiter, then save and reconstruct with next chunk”.
So in this case, is there a problem with the mail body or the code?

Actions #3

Updated by chen dy almost 3 years ago

  • Assignee set to Victor Julien
Actions #4

Updated by Victor Julien almost 3 years ago

  • Assignee deleted (Victor Julien)

Please leave setting the assignee to the team, thank you.

Actions #5

Updated by Philippe Antoine over 1 year ago

  • Assignee set to OISF Dev
Actions #6

Updated by Philippe Antoine about 1 year ago

Could you share as a pcap or even better, a suricata-verify test ?

Actions #7

Updated by Philippe Antoine 6 months ago

  • Assignee changed from OISF Dev to Philippe Antoine
  • Target version changed from TBD to 8.0.0-beta1
Actions #8

Updated by Philippe Antoine 6 months ago

  • Status changed from New to In Review
Actions #9

Updated by Philippe Antoine 6 months ago

  • Status changed from In Review to Closed
Actions #10

Updated by Philippe Antoine 6 months ago

  • Related to Feature #3260: SMTP Base64 Decoding of Message Body added
Actions

Also available in: Atom PDF