[exim-dev] [Bug 2931] New: Logging of SMTP command buffer c…

Αρχική Σελίδα
Delete this message
Reply to this message
Συντάκτης: admin
Ημερομηνία:  
Προς: exim-dev
Αντικείμενο: [exim-dev] [Bug 2931] New: Logging of SMTP command buffer containing quotes is ambiguous
https://bugs.exim.org/show_bug.cgi?id=2931

            Bug ID: 2931
           Summary: Logging of SMTP command buffer containing quotes is
                    ambiguous
           Product: Exim
           Version: 4.97
          Hardware: All
                OS: All
            Status: NEW
          Severity: bug
          Priority: medium
         Component: Logging
          Assignee: unallocated@???
          Reporter: bugzilla.exim.simon@???
                CC: exim-dev@???


The SMTP command buffer and various other messages logged inside smtp_in.c are
wrapped in quotes. If the content contains quotes it becomes very difficult to
parse the log correctly because the quoted section can be ended prematurely.

This happens if someone sends JSON to Exim (attempting to exploit a non-SMTP
service) with a string like:
{"hello": ["world"]}

Exim will log this as: SMTP syntax error in "{"hello": ["world"]}"
H=[106.75.130.83]:39174

I could embed H= content in the SMTP command and a log parser may potentially
make use of a faked IP address.

The distinguished name and possibly other externally supplied strings enclosed
in quotes could also contain quotes.

Partial patch at https://github.com/Exim/exim/pull/88 (doesn't include any
necessary changes in test case output).

--
You are receiving this mail because:
You are on the CC list for the bug.