Re: SECURITY.NNOV: The Bat! <cr> bug

From: hurtta+z3at_private
Date: Tue Apr 24 2001 - 03:26:34 PDT

  • Next message: Warren Young: "Re: Redhat 7 insecure umask"

    > I was reminded of this again recently because a Notes user on another
    > list complained that a list "control" message they sent was bounced.
    > That list processer reads its commands from the Subject: line and
    > it turned out that the combination of Notes client and Notes SMTP
    > gateway happily sent a non-standards compliant message, failing to
    > put the required blank line at the end of the message header block.
    > It was the SMTP server on the list processer machine, not the list
    > processor, that rejected the message, and it did so because it was
    > not a valid message according to the standards (a message can have a
    > null body but the header block ends with the first blank line).
    
    Well,
    
    Actually message standards (or RFC 822 actually) doe snot requile that blank line,
    if message do not have body.
    
    
    Note that grammar is:
    
         message     =  fields *( CRLF *text )       ; Everything after
                                                     ;  first null line
                                                     ;  is message body
    
    Therefore
    
        message     =  fields
    
    is also valid (ie, without that CRLF.)
    
    
    I'm afrain that Notes is correct on here....
    
    
    
    --
              /"\                           |  Kari
              \ /     ASCII Ribbon Campaign |    Hurtta
               X      Against HTML Mail     |
              / \                           |
    



    This archive was generated by hypermail 2b30 : Tue Apr 24 2001 - 22:47:58 PDT