MIME-tools: Virus detection evasion — GLSA 200411-06

MIME-tools doesn't handle empty MIME boundaries correctly. This may prevent some virus-scanning programs which use MIME-tools from detecting certain viruses.

Affected packages

Background

MIME-tools is a Perl module containing functions to handle MIME attachments.

Description

MIME-tools doesn't correctly parse attachment boundaries with an empty name (boundary="").

Impact

An attacker could send a carefully crafted email and evade detection on some email virus-scanning programs using MIME-tools for attachment decoding.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=dev-perl/MIME-tools-5.415"

References

• MIMEDefang announcement
• CVE-2004-1098

Release date
November 02, 2004

Latest revision
May 22, 2006: 02

Severity
low

Exploitable
remote

Bugzilla entries

• 69181