CVE-2003-1016

Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use malformed quoting in MIME headers, parameters, and values, including (1) fields that should not be quoted, (2) duplicate quotes, or (3) missing leading or trailing quote characters, which may be interpreted differently by mail clients.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.uniras.gov.uk/vuls/2004/380375/mime.htm	Vendor Advisory
http://marc.info/?l=bugtraq&m=109521027007616&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/17336

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:clearswift:mailsweeper:4.3.11:::::::*
	cpe:2.3:a:clearswift:mailsweeper:4.3.13:::::::*
	cpe:2.3:a:f-secure:internet_gatekeeper:6.32:::::::*
	cpe:2.3:a:f-secure:internet_gatekeeper:6.4:::::::*
	cpe:2.3:a:paul_l_daniels:ripmime:1.2.0:::::::*
	cpe:2.3:a:paul_l_daniels:ripmime:1.2.7:::::::*
	cpe:2.3:a:paul_l_daniels:ripmime:1.3.2.0:::::::*
	cpe:2.3:a:clearswift:mailsweeper:4.3.10:::::::*
	cpe:2.3:a:f-secure:internet_gatekeeper:6.3:::::::*
	cpe:2.3:a:f-secure:internet_gatekeeper:6.31:::::::*
	cpe:2.3:a:paul_l_daniels:ripmime:1.2.5:::::::*
	cpe:2.3:a:paul_l_daniels:ripmime:1.2.2:::::::*
	cpe:2.3:a:paul_l_daniels:ripmime:1.3.2.2:::::::*
	cpe:2.3:a:clearswift:mailsweeper:4.3.7:::::::*
	cpe:2.3:a:paul_l_daniels:ripmime:1.2.3:::::::*
	cpe:2.3:a:paul_l_daniels:ripmime:1.2.6:::::::*
	cpe:2.3:a:paul_l_daniels:ripmime:1.3.2.3:::::::*
	cpe:2.3:a:clearswift:mailsweeper:4.3.15:::::::*
	cpe:2.3:a:paul_l_daniels:ripmime:1.2.1:::::::*
	cpe:2.3:a:paul_l_daniels:ripmime:1.2.4:::::::*
	cpe:2.3:a:clearswift:mailsweeper:4.3.14:::::::*
	cpe:2.3:a:clearswift:mailsweeper:4.3.8:::::::*

Information

Published : 2004-10-19 21:00

Updated : 2017-07-10 18:29

NVD link : CVE-2003-1016

Mitre link : CVE-2003-1016

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

clearswift

mailsweeper

f-secure

internet_gatekeeper

paul_l_daniels

ripmime

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.uniras.gov.uk/vuls/2004/380375/mime.htm", "name": "http://www.uniras.gov.uk/vuls/2004/380375/mime.htm", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://marc.info/?l=bugtraq&m=109521027007616&w=2", "name": "20040914 Corsaire Security Advisory - Multiple vendor MIME field quoting issue", "tags": [], "refsource": "BUGTRAQ"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17336", "name": "mime-quote-filtering-bypass(17336)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use malformed quoting in MIME headers, parameters, and values, including (1) fields that should not be quoted, (2) duplicate quotes, or (3) missing leading or trailing quote characters, which may be interpreted differently by mail clients."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2003-1016", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}}, "publishedDate": "2004-10-20T04:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.13:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:f-secure:internet_gatekeeper:6.32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:f-secure:internet_gatekeeper:6.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:paul_l_daniels:ripmime:1.2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:paul_l_daniels:ripmime:1.2.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:paul_l_daniels:ripmime:1.3.2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:f-secure:internet_gatekeeper:6.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:f-secure:internet_gatekeeper:6.31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:paul_l_daniels:ripmime:1.2.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:paul_l_daniels:ripmime:1.2.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:paul_l_daniels:ripmime:1.3.2.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:paul_l_daniels:ripmime:1.2.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:paul_l_daniels:ripmime:1.2.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:paul_l_daniels:ripmime:1.3.2.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.15:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:paul_l_daniels:ripmime:1.2.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:paul_l_daniels:ripmime:1.2.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.14:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-11T01:29Z"}