oss-security - CVE request: mail ruby gem <2.6.0 vulnerable to SMTP injection via recipient email addresses

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CALPTtNXyZaNwHaLa+XhB6Dvac1cy5EeVa+ce1aDRW4a5WGSJ6Q@mail.gmail.com>
Date: Fri, 11 Dec 2015 07:45:49 -0800
From: Reed Loden <reed@...dloden.com>
To: oss-security@...ts.openwall.com, 
	Assign a CVE Identifier <cve-assign@...re.org>
Subject: CVE request: mail ruby gem <2.6.0 vulnerable to SMTP injection via
 recipient email addresses

Takeshi Terada (Mitsui Bussan Secure Directions, Inc.) released a
whitepaper entitled "SMTP Injection via recipient email addresses" (
http://www.mbsd.jp/Whitepaper/smtpi.pdf). This whitepaper has a section
discussing how one such vulnerability affected the 'mail' ruby gem (see
section 3.1).

Whitepaper has all the specific details, but basically the 'mail' ruby gem
module is prone to the recipient attack as it does not validate nor
sanitize given recipient addresses. Thus, the attacks described in chapter
2 of the whitepaper can be applied to the gem without any modification. The
'mail' ruby gem itself does not impose a length limit on email addresses,
so an attacker can send a long spam message via a recipient address unless
there is a limit on the application's side. This vulnerability affects only
the applications that lack input validation.

'mail' is a "A Really Ruby Mail Library" for Ruby.

Ruby gem: mail (https://rubygems.org/gems/mail)
Affects: 2.5.4 and earlier
Fixed in: 2.6.0
Fixed by
https://github.com/mikel/mail/commit/72befdc4dab3e6e288ce226a7da2aa474cf5be83

Can a CVE be assigned? Since the issue was fixed in 2013, not sure if that
means it needs a 2013 era CVE or if a 2015 one will work since it wasn't
found to be a vulnerability until this year.

Note, the paper author has informed me "BTW, while investigating the source
code of Mail, I came to think the fault might be more on Net::SMTP's side.
It is difficult to say who is responsible for it, Net::SMTP, Mail or
application developers (library users) though."

Either way, vuln needs to be tracked, and a change in 'mail' did mitigate
it for now (and affects all their delivery methods, not just 'smtp').

Thanks,
~reed

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.