Sep 15, 2004 : NISCC Identifies Email Security Flaws

📅 September 15, 2004 - The National Infrastructure Security Co-ordination Centre (niscc.gov.uk), the body responsible for protecting the UK's critical national infrastructure against electronic attack, issued an urgent warning to users about eight serious new security flaws affecting hundreds of email gateway products.

Flaws in the MIME Internet email protocol extension - a standard for encoding attachments to emails that is used in email clients, Web browsers, antivirus products and content checkers ? will enable hackers to penetrate content checking and antivirus tools and launch denial of service attacks.
The vulnerabilities can be exploited with "malformed" subjects using multiple fields, non-standard white space and non-standard quoting to avoid content checking functionality, and therefore allowing malicious code through content filtering and antivirus software. The flaws were discovered over a year ago by security consultancy Corsaire after working on arge insurance company's email system and were only revealed now because of severity and the co-ordination needed between vendors to fix their products.
A number of vendors have issued patches for the flaws and Apple, HP, MessageLabs and Mozilla have already said their products are not affected by the vulnerabilities. Antivirus company F-Secure has confirmed its Internet Gatekeeper server products are vulnerable and that this will be fixed in the next release, scheduled for the fourth quarter this year.