oss-security - Re: PGP/MIME and S/MIME mail clients vulnerabilities

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 16 May 2018 07:57:21 -0700
From: Matthew Fernandez <matthew.fernandez@...il.com>
To: oss-security@...ts.openwall.com
Cc: Christian Brabandt <cb@...bit.org>
Subject: Re: PGP/MIME and S/MIME mail clients vulnerabilities

> On May 16, 2018, at 02:39, Yves-Alexis Perez <corsac@...ian.org> wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> 
> On Tue, 2018-05-15 at 20:39 +0200, Florian Weimer wrote:
>> * Christian Brabandt:
>> 
>>> Looks like details have just been published:
>>> https://efail.de/
>> 
>> I don't see any discussion of cid: URLs.  Are vendors planning to fix
>> vectors related to those as well?
> 
> Hi Florian,
> 
> I might have missed something, but I'm not sure what you're referring to here?

I presume what Florian is asking about is Content-ID links [0]. One purpose of CID links is to include images as a message part and then reference them from the HTML email content. I would think a CID URL would not be immediately vulnerable to the “direct exfiltration” attack because it shouldn’t result in a network fetch; just a lookup locally. However, RFC 2392 requires the IDs to be “globally unique” and some mail clients (e.g. iOS Mail) take the RFC at its word and render images from CID URLs that reference content included in entirely distinct emails in your mailbox. Perhaps the attacker can hide their payload within a message part with the chosen ID included in another email.

I haven’t fully thought through whether this is feasible, but this is a fairly convoluted vector that an attacker has no reason to use if they have available the attack described on the efail site. Closing exploitation of the original attack looks like it would cut off this hypothetical indirect attack too.

  [0]: RFC 2392, https://tools.ietf.org/html/rfc2392 <https://tools.ietf.org/html/rfc2392>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.