256112 - Spam mail arrives already read / Spam mail includes X-Mozilla headers that get parsed

Status: RESOLVED DUPLICATE of bug 196749

(MailNews Core :: Networking: POP, defect)

Description

[Ren Hoek]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040608
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040608

I received a piece of spam today, but it showed up already 'as read' in my
mailbox. Turns out there's two pairs of X-Mozilla headers in the email when you
'view source'.

X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000

I presume this is done to circumvent the spam filters. This however could open
up a _very_ nasty overflow bug if people start sending out emails with invalid
headers that get parsed by Mozilla instead of the correct ones. Imagine a header
with shell code included; it would be like Outlook, trojans without the need to
open the email to start them.

Suggested fix: 

Filter all X-Mozilla tags out of incoming emails, they shouldn't be in there to
begin with.

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Comment 1

[Ren Hoek]

Attachment: Headers of spam email

IP's and email addresses have been privacy editted, otherwise intact as it
arrived by POP.

Comment 2

[Jesse Ruderman]

*** This bug has been marked as a duplicate of 196749 ***