[Esa-l] Email Sanitizer hanging

[John D. Hardin]

On Wed, 25 Oct 2000, Dan Bongert wrote:

> I have the sanitizer running well under FreeBSD 4.0-RELEASE, and
> it's doing everything as advertised (except mangling HTML and Word
> filenames--my users complained). The only problem I have with it
> is that every so often, perl runs away and takes up as much CPU
> time as possible. This also happened with an unmodified script,

Are you using the most current version of the script? Earlier versions
did have some infinite loops on certain attachment filenames.

Can you gzip and send me a copy of the message it hangs on? 

> and I don't see how my changes might have caused any problem:
> 
>   MANGLE_EXTENSIONS=''
>   #MANGLE_EXTENSIONS='html?|exe|com|cmd|bat|pif|sc[rt]|lnk|dll|ocx|do[ct]|xl[swt
> ]|p[po]t|rtf|vb[se]?|hta|p[lm]|sh[bs]|hlp|chm|eml|ws[cfh]|ad[ep]|jse?|md[abew]|m
> s[ip]|reg|asd|cil'
> 
> Is my only change from the stock script.

Ouch. That pretty much completely defangs the sanitizer.

If your users are complaining about mangled .DOC and .HTML attachment
filenames, then cut just those out of MANGLE_EXTENSIONS. Nulling the
entire regex opens you up almost as widely as not having the sanitizer
in place at all, and prevents you from poisoning *any* attachments
proactively (e.g. *.vbs to prevent ILY-style attacks).

--
 John Hardin KA7OHZ   ICQ#15735746   http://www.wolfenet.com/~jhardin/
 jhardin at wolfenet.com      pgpk -a finger://gonzo.wolfenet.com/jhardin
  768: 0x41EA94F5 - A3 0C 5B C2 EF 0D 2C E5  E9 BF C8 33 A7 A9 CE 76 
 1024: 0xB8732E79 - 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  "Bother," said Pooh as he struggled with /etc/sendmail.cf, "it never
  does quite what I want. I wish Christopher Robin was here."
				-- Peter da Silva in a.s.r
-----------------------------------------------------------------------
   4 days until Daylight Savings Time ends