unofficial mirror of notmuch@notmuchmail.org
 help / color / mirror / code / Atom feed
* a DoS vulnerability associated with conflated Message-IDs?
@ 2012-03-08 16:37 Daniel Kahn Gillmor
  2012-03-08 17:04 ` James Vasile
  2012-10-29 11:15 ` Peter Wang
  0 siblings, 2 replies; 9+ messages in thread
From: Daniel Kahn Gillmor @ 2012-03-08 16:37 UTC (permalink / raw)
  To: notmuch mailing list

[-- Attachment #1: Type: text/plain, Size: 1184 bytes --]

notmuch currently treats all messages with the same Message-ID as
the same message.  I think this could be a vulnerability :(

If two messages have the same Message-ID, is there a guarantee of which
of these messages will be produced during a notmuch show?

Either way, it seems to create a potential DoS attack on notmuch users.

-------

The attack:

Let's say there is a public mailing list that Mallory knows
bob@example.org is subscribed to.  alice@example.net sends a message to
the public mailing list detailing some problem that Bob probably needs
to deal with.

Mallory can just craft a content-free e-mail (or a dozen?) with the same
Message-ID as Alice's message, and send it to bob@example.org.

If Bob uses notmuch, he is much more likely to read one of Mallory's
bogus e-mails than to read Alice's original message.

Mallory's e-mail could also be crafted to look like spam, in the hopes
that Bob's spamfiltering scripts would mark the original message's
Message-ID as spam.

--------

I don't know how to fix this, and i'd be happy to hear if someone thinks
my analysis above is flawed and this isn't really a problem.

Any ideas on how to approach this?

       --dkg

[-- Attachment #2: Type: application/pgp-signature, Size: 965 bytes --]

^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2022-07-30 12:41 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-03-08 16:37 a DoS vulnerability associated with conflated Message-IDs? Daniel Kahn Gillmor
2012-03-08 17:04 ` James Vasile
2012-03-08 17:16   ` Daniel Kahn Gillmor
2012-03-08 17:38     ` Jeremy Nickurak
2012-03-10 17:38       ` Tom Prince
2012-10-29 11:15 ` Peter Wang
2017-08-04 20:42   ` David Bremner
2017-08-04 22:15     ` Daniel Kahn Gillmor
2022-07-30 12:41       ` David Bremner

Code repositories for project(s) associated with this public inbox

	https://yhetil.org/notmuch.git/

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).