BugTraq
base64 Sep 22 2003 12:49PM
"Ilya Teterin" (alienhard mail ru) (5 replies)
Re: base64 Sep 26 2003 08:38PM
Earl Hood (earl earlhood com)
Re: base64 Sep 23 2003 04:50PM
Alexander Ogol (sanyok_nospam prophysoft org ua) (1 replies)
Re: base64 Sep 24 2003 07:09AM
Christian Vogel (chris obelix hedonism cx) (2 replies)
Re: base64 Sep 24 2003 07:01PM
David Wilson (David Wilson isode com)
>
> 99.99% of all software should create the standard form, so please
> let the tiny fraction of users with broken software suffer
> when their mails get rejected.
>
> (Note: this of course applies not only to Base64 but to all aspects
> of header-parsing, file-format guessing etc...)

I wish it were true...

I see many invalid messages, e.g.

- Using CR or LF not as CR LF, or including NUL. (Forbidden for MIME
messages, except for Content-transfer-encoding: binary, which needs an
SMTP Extension which few MTAs support).

- Using encoded words in MIME header parameter values (forbidden by RFC
2047 Page 8).

- Not quoting parameters when required

- Not setting Content-transfer-encoding: 8bit on all enclosing MIME
composite types (multipart or message/rfc822) when 8bit is used in a
data part (see RFC 2045 Section 6.4).

- Using characters outside the advertised character set. (E.g. using the
MS 'smart quotes' in something advertised as iso-8859-1).

- Not using the 'minimum' character set (e.g. saying iso-8859-1 when
us-ascii would do).

- Using 8bit characters in headers.

That's just in the structure of the message.

The original post in this thread made the valid point that different
interpreters of MIME messages make different assumptions. That applies
to other areas as well as base64 decoding.

cheers

David Wilson David.Wilson (at) isode (dot) com [email concealed]
Isode Limited Tel: +44 (0) 20 8783 2961
http://www.isode.com

[ reply ]
Re: base64 Sep 24 2003 06:30PM
der Mouse (mouse Rodents Montreal QC CA)
Re: base64 Sep 23 2003 04:18PM
Birl (sbirl temple edu) (1 replies)
Re: base64 Sep 23 2003 06:10PM
Lothar Kimmeringer (bugtraq kimmeringer de) (2 replies)
Re: base64 Sep 24 2003 06:24PM
David Wilson (David Wilson isode com) (2 replies)
Re: base64 Sep 25 2003 07:10AM
Christian Vogel (chris obelix hedonism cx)
Re: base64 Sep 25 2003 12:27AM
Earl Hood (earl earlhood com)
Re: base64 Sep 24 2003 05:01PM
Seth Breidbart (sethb panix com)
Re: base64 Sep 23 2003 06:44AM
Erwan David (Erwan David trusted-logic fr)
Re: base64 Sep 22 2003 04:59PM
Bennett Todd (bet rahul net)


 

Privacy Statement
Copyright 2010, SecurityFocus