117159 - The S/MIME engine doesn't process application/pkcs7-mime content types.

Status: VERIFIED DUPLICATE of bug 119418

(MailNews Core :: Security: S/MIME, defect)

Description

[Daniel Lanovaz]

From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Q312461)
BuildID:    20011221

The latest 0.9.7 mail tool does not recognize the
content type application/pkcs7-mime as a valid content
type. It's using application/x-pkcs7-mime.

Outlook 2002 is now using application/pkcs7-mime
for signed and encrypted S/MIME messages. Note that
Outlook 2002 still uses a application/x-pkcs7-signature
protocol for clear-text signed messages.

I have attached the original Outlook 2002 e-mail
message as well as a screen shot. In the screen shot
you'll notice the mail tool simply treats the
PKCS7 (CMS) blob as a regular file attachment.

The file mailnews/mime/src/mimei.cpp, the function
mime_find_class() contains the lines:


#ifdef ENABLE_SMIME
    else if (!nsCRT::strcasecmp(content_type, APPLICATION_XPKCS7_MIME))
	        clazz = (MimeObjectClass *)&mimeEncryptedCMSClass;
#endif

Clearly only using APPLICATION_XPKCS7_MIME for
pattern matching.

Cheers,
Daniel


Reproducible: Always
Steps to Reproduce:
1. Send a non clear-text signed message from Outlook 2002.
2. Read the message in your mail reader.


Actual Results:  Note that the S/MIME content is treated as an attachment.

Expected Results:  The mail message should be viewed as any other signed
mail message that uses an application/x-pkcs7-mime
content type.

Comment 1

[Daniel Lanovaz]

Attachment: Outlook 2002 raw S/MIME message.

Comment 2

[Daniel Lanovaz]

Attachment: Screen shot of the mail tool.

Comment 3

[Daniel Lanovaz]

The same problem was reported in 118283.

Comment 4

[Kai Engert [:KaiE:]]

reassigning to crypto team

Comment 5

[Kai Engert [:KaiE:]]

*** Bug 118283 has been marked as a duplicate of this bug. ***

Comment 6

[Kai Engert [:KaiE:]]

*** This bug has been marked as a duplicate of 119418 ***

Comment 7

[John Unruh]

Verified dupe.