diff options
| author | Jacques Vidrine <nectar@FreeBSD.org> | 2004-08-27 14:43:07 +0000 |
|---|---|---|
| committer | Jacques Vidrine <nectar@FreeBSD.org> | 2004-08-27 14:43:07 +0000 |
| commit | b95b3a35351f17fd75969d8661439245e2a01942 (patch) | |
| tree | 15628f0b1a0f1a01dc63adb9bee32b8f71acac91 /security/vuxml | |
| parent | 55846c0bc7c5beebac45af084982ec1a2d9f71a3 (diff) | |
Notes
Diffstat (limited to 'security/vuxml')
| -rw-r--r-- | security/vuxml/vuln.xml | 39 |
1 files changed, 38 insertions, 1 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index f64752cca45e..5f82b69dbfda 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -32,8 +32,45 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="85e19dff-e606-11d8-9b0a-000347a4fa7d"> + <topic>ripMIME -- decoding bug allowing content filter bypass</topic> + <affects> + <package> + <name>ripmime</name> + <range><lt>1.3.2.3</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>ripMIME may prematurely terminate decoding Base64 encoded + messages when it encounters multiple blank lines or other + non-standard Base64 constructs. Virus scanning and content + filtering tools that use ripMIME may therefore be + bypassed.</p> + <p>The ripMIME CHANGELOG file says:</p> + <blockquote cite="http://www.pldaniels.com/ripmime/CHANGELOG"> + <p>There's viruses going around exploiting the ability to + hide the majority of their data in an attachment by using + blank lines and other tricks to make scanning systems + prematurely terminate their base64 decoding.</p> + </blockquote> + </body> + </description> + <references> + <bid>10848</bid> + <url>http://www.osvdb.org/8287</url> + <url>http://www.pldaniels.com/ripmime/CHANGELOG</url> + <url>http://secunia.com/advisories/12201</url> + <url>http://xforce.iss.net/xforce/xfdb/16867</url> + </references> + <dates> + <discovery>2004-07-30</discovery> + <entry>2004-08-27</entry> + </dates> + </vuln> + <vuln vid="1ecf4ca1-f7ad-11d8-96c9-00061bc2ad93"> - <topic>moinmoin ACL group bypass (and lack thereof bypass)</topic> + <topic>moinmoin -- ACL group bypass</topic> <affects> <package> <name>moinmoin</name> |