bugMHonArc - Bugs: bug #32014, CVE-2010-1677: DoS when processing...


You are not allowed to post comments on this tracker with your current authentication level.

bug #32014: CVE-2010-1677: DoS when processing html messages with deep tag nesting

Submitted by:  Earl Hood <ehood>
Submitted on:  Thu 30 Dec 2010 08:45:51 PM UTC  
Category: MIME FilterSeverity: 6 - Security
Priority: 5 - NormalItem Group: Security
Status: FixedPrivacy: Public
Assigned to: Earl Hood <ehood>Open/Closed: Closed
Operating System: AllPerl Version: All
Component Version: 2.6.16Fixed Release: 2.6.17

Thu 30 Dec 2010 08:56:17 PM UTC, comment #1:

mhtxthtml.pl filter modified to reject any message with
nested tags. This is invalid HTML, so any message
that contains it would likely indicate someone trying
to attack an archive web site.

Earl Hood <ehood>
Project AdministratorIn charge of this item.
Thu 30 Dec 2010 08:45:51 PM UTC, original submission:

If a malformed HTML message contains something like the following:


But to a much larger extent, will cause mhonarc to consume
a alot of CPU resources to strip out the data.

Earl Hood <ehood>
Project AdministratorIn charge of this item.


No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by ehood (Submitted the item)

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 09 Jan 2011 09:22:51 AM UTCehoodItem GroupUndesired Behavior=>Security
    Sun 09 Jan 2011 08:36:18 AM UTCehoodStatusReady For Test=>Fixed
      Fixed Release=>2.6.17
    Thu 30 Dec 2010 08:56:17 PM UTCehoodStatusIn Progress=>Ready For Test

    Back to the top

    Powered by Savane 3.1-cleanup1