276257 - Does browser accept %0a and %0d which allow exploit?

Status: RESOLVED INVALID

(SeaMonkey :: General, defect)

Description

[John Malmberg]

Does browser accept %0a and %0d which allow this exploit to send or relay spam?

The exploit described can be be used on other ports besides port 25.

This allows a web browser to do client side scripting to a remote server, which
could be for malicious exploits.

Mozilla appears to have port 25 access disabled for security reasons, but as
long as the control characters can be passed through, other ports such as 8080
can be used for exploits.

All this means is that the malicious web site needs to do is use an additional
unsecured computer, just using the browser.

Comment 1

[Daniel Veditz [:dveditz] (OOO: back Aug 26)]

If we discover any linefeeds after unescaping the user/pass we refuse to issue
the request. Even with an SMTP server set up on a non-standard port we'd not be
vulnerable to this.