Outlook/outlook Express

GovernmentSecurity.org > The Archives > Exploit Articles

qcred11

Apr 29 2004, 04:31 AM

QUOTE

Hello,

A number of Microsoft mail programs fail when they attempt to download a
message containing ASCII NUL in the message body. The clients we tested
are:

Outlook Express 6.00.2800.1106
Outlook 2002 (10.2627.3501) SP-1
Outlook 2003 (11.5608.5606)

Once the client attempts to download the particular message, the
"Sending/Receiving" email dialog locks up and can not be closed. The
next attempt to download email will also fail.

Watching on a packet tracer shows that all clients lock up after the
body of the RETR response has been sent. Presumably they can't see the
<CRLF>.<CRLF> after the NUL character. Any mail after the message can
not be retrieved until the NUL-containing email is removed from the
spool manually.

The following Python script produces the problem:

import smtplib
from_address = "nobody@microsoft.com"
to_address = "nobody@microsoft.com"
message = "Before\r\n\000\r\nAfter"
smtp = smtplib.SMTP("localhost")
smtp.set_debuglevel(1)
smtp.sendmail(from_address, [to_address], message)
smtp.quit()

I've quickly looked through the SMTP and POP3 RFC's and found nothing
that prohibits this kind of email message. The messages get through
unaltered on recent versions of qmail and postfix.

Unfortunately I'm not in a position to test the IMAP support in Outlook
for this bug, and my searches for any prior information on it have come
back with nothing.

Regards,
Ben Rampling

daguilar01

Apr 29 2004, 04:39 AM

thx for the info qcred11, keep the good posts coming,

ghasedak

Apr 30 2004, 02:27 AM

Thanks for this information

but how how can I do this in php?

smtp.set_debuglevel(1)

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.