Re: Bypassing SMTP Content Protection with a Flick of a Button

From: Gossi The Dog (gossiat_private)
Date: Fri Sep 13 2002 - 05:13:43 PDT

Next message: Mella Marco: "Scan against Enterasys SSR8000 crash the system"

Previous message: Marco van Berkum: "Re: xbreaky symlink vulnerability"
Maybe in reply to: Aviram Jenik: "Bypassing SMTP Content Protection with a Flick of a Button"
Next in thread: Steven M. Bellovin: "Re: Bypassing SMTP Content Protection with a Flick of a Button"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Regarding NAI Webshield;

Webshield Solaris, e250 and e500 all reassemble the messages and correctly
scan them.

Webshield SMTP (ie for NT/2000) does not follow the RFC, and the messages
are blindly passed on, bypassing content filters, virus checking etc.

-----Original Message-----
From: Aviram Jenik [mailto:aviramat_private]
Sent: 12 September 2002 14:45
To: bugtraqat_private
Subject: Bypassing SMTP Content Protection with a Flick of a Button



  Bypassing SMTP Content Protection with a Flick of a Button
------------------------------------------------------------------------

Article reference: http://www.securiteam.com/securitynews/5YP0A0K8CM.html


<snip>

Next message: Mella Marco: "Scan against Enterasys SSR8000 crash the system"
Previous message: Marco van Berkum: "Re: xbreaky symlink vulnerability"
Maybe in reply to: Aviram Jenik: "Bypassing SMTP Content Protection with a Flick of a Button"
Next in thread: Steven M. Bellovin: "Re: Bypassing SMTP Content Protection with a Flick of a Button"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Sep 13 2002 - 07:56:36 PDT