Vulnerability CVE-2004-0052 - CERT Civis.Net

Vulnerability Name:

CVE-2004-0052 (CCN-17334)

Assigned:

2004-09-13

Published:

2004-09-13

Updated:

2017-07-11

Summary:

Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use non-standard separator characters, or use standard separators incorrectly, within MIME headers, fields, parameters, or values, which may be interpreted differently by mail clients.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Bypass Security

References:

Source: CCN
Type: Full-Disclosure Mailing List, Mon Sep 13 2004 - 06:47:05 CDT
Corsaire Security Advisory - Multiple vendor MIME separator issue

Source: MITRE
Type: CNA
CVE-2004-0052

Source: BUGTRAQ
Type: UNKNOWN
20040914 Corsaire Security Advisory - Multiple vendor MIME separator issue

Source: CCN
Type: OSVDB ID: 10343
Multiple Content Monitor Software MIME Decoding Malformed Separators Filter Bypass

Source: CCN
Type: BID-11157
Multiple Vendor MIME Encapsulation Content Checking Filter Bypass Vulnerabilities

Source: CCN
Type: NISCC Vulnerability Advisory 380375
Vulnerability Issues in MIME

Source: MISC
Type: Vendor Advisory
http://www.uniras.gov.uk/vuls/2004/380375/mime.htm

Source: XF
Type: UNKNOWN
mime-separator-filtering-bypass(17334)

Source: XF
Type: UNKNOWN
mime-separator-filtering-bypass(17334)

Vulnerable Configuration:

Configuration 1:

cpe:/a:clearswift:mailsweeper:4.3.7:*:*:*:*:*:*:*

OR cpe:/a:clearswift:mailsweeper:4.3.8:*:*:*:*:*:*:*

OR cpe:/a:clearswift:mailsweeper:4.3.10:*:*:*:*:*:*:*

OR cpe:/a:clearswift:mailsweeper:4.3.11:*:*:*:*:*:*:*

OR cpe:/a:clearswift:mailsweeper:4.3.13:*:*:*:*:*:*:*

OR cpe:/a:clearswift:mailsweeper:4.3.14:*:*:*:*:*:*:*

OR cpe:/a:clearswift:mailsweeper:4.3.15:*:*:*:*:*:*:*

OR cpe:/a:f-secure:internet_gatekeeper:6.3:*:*:*:*:*:*:*

OR cpe:/a:f-secure:internet_gatekeeper:6.4:*:*:*:*:*:*:*

OR cpe:/a:f-secure:internet_gatekeeper:6.31:*:*:*:*:*:*:*

OR cpe:/a:f-secure:internet_gatekeeper:6.32:*:*:*:*:*:*:*

OR cpe:/a:paul_l_daniels:ripmime:1.2.0:*:*:*:*:*:*:*

OR cpe:/a:paul_l_daniels:ripmime:1.2.1:*:*:*:*:*:*:*

OR cpe:/a:paul_l_daniels:ripmime:1.2.2:*:*:*:*:*:*:*

OR cpe:/a:paul_l_daniels:ripmime:1.2.3:*:*:*:*:*:*:*

OR cpe:/a:paul_l_daniels:ripmime:1.2.4:*:*:*:*:*:*:*

OR cpe:/a:paul_l_daniels:ripmime:1.2.5:*:*:*:*:*:*:*

OR cpe:/a:paul_l_daniels:ripmime:1.2.6:*:*:*:*:*:*:*

OR cpe:/a:paul_l_daniels:ripmime:1.2.7:*:*:*:*:*:*:*

OR cpe:/a:paul_l_daniels:ripmime:1.3.2.0:*:*:*:*:*:*:*

OR cpe:/a:paul_l_daniels:ripmime:1.3.2.2:*:*:*:*:*:*:*

OR cpe:/a:paul_l_daniels:ripmime:1.3.2.3:*:*:*:*:*:*:*

Denotes that component is vulnerable