Bug #6023: smtp: Attachment not being md5 matched - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #6023

closed

smtp: Attachment not being md5 matched

Added by Thomas Winter almost 2 years ago. Updated almost 2 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Philippe Antoine

Target version:

7.0.0

Affected Versions:

7.0.0-rc1

Effort:

Difficulty:

Label:

Description

Previously we were using 4.0.6 and are in the process of upgrading due to EOL. Currently testing using 7.0.0-rc1.

EICAR file is 68 bytes and md5 is 44d88612fea8a8f36de82e1278abb02f but is not being matched.
Debug shows that the mime-decoder is using 70 bytes and including the \r\n delimiter, resulting in md5 of e7e5fa40569514ec442bbdf755d89c2f.
When retrieved via HTTP then the file is md5 matched.

I believe this to be caused by some of the recent mime and smtp fixes which included refactoring delimiter handling.
I have attached a small diff which makes the md5 get matched by excluding the delimiter when copying over to the buffer but I don't how valid this. This line was changed in commit b82b8825e79 (part of #5316 fix).

I've attached a packet capture of the smtp transaction, packet number 17 is the smtp packet with the attachment.

Files

Download all files

delim_diff.txt (502 Bytes) delim_diff.txt		Thomas Winter, 04/25/2023 10:27 PM
smtp_eicar.pcapng (3.73 KB) smtp_eicar.pcapng		Thomas Winter, 04/25/2023 10:27 PM
old_smtp_diff.txt (1.19 KB) old_smtp_diff.txt		Thomas Winter, 04/27/2023 11:39 PM
verify_failures.txt (1.46 KB) verify_failures.txt		Thomas Winter, 05/15/2023 12:44 AM