Getmail and Maildrop tricked into delivering truncated emails

Miroslav Rovis <[email protected]> Thu, 14 Dec 2017 08:20:10 +0000
Newsgroups	gmane.mail.maildrop
Message-ID	<20171214082010.GA980@gdOv>
Hi!

I forgot I wasn't subscribed since a few months.

I just finished putting up a page with all, well: a lot of, the info:

"bad message from server!" and 144 msgs truncated
https://www.croatiafidelis.hr/foss/cap/cap-171213-server-bad-mail/

While all is there, and some of the stuff from:
https://www.croatiafidelis.hr/foss/cap/cap-171213-server-bad-mail/#files-veri
couldn't fit in the email attachment, most notably the network traces, here's
the summary:

I ran:

$ getmail --fingerprint -r config/mirorovis\@croatiafidelishr 2>&1 \
	| tee .getmail/log/getmail_`date +%y%m%d_%H%M%S`_`hostname`.log 

getmail version 4.54.0
Copyright (C) 1998-2012 Charles Cazabon.  Licensed under the GNU GPL version 2.
SimpleIMAPSSLRetriever:[email protected]@lin22.mojsite.com:993:
IMAP SSL connection <imaplib.IMAP4_SSL instance at 0x3c4b8294560> established with fingerprint c9c83d6ecf350841c16e32ca990dccc66b7beafcebe2c6dc6853a279e59c8ed3 using cipher ECDHE-RSA-AES256-GCM-SHA384:TLSv1.2:256
  msg   1/244 (4907 bytes) from <unknown> delivered to MDA_external command maildrop (), deleted
bad message from server!  msg   2/244 (6761 bytes) from <unknown> delivered to MDA_external command maildrop (), deleted
bad message from server!  msg   3/244 (4720 bytes) from <unknown> delivered to MDA_external command maildrop (), deleted
bad message from server!  msg   4/244 (23199 bytes) from <unknown> delivered to MDA_external command maildrop (), deleted

and the first 100 msgs were all like these first three. Only the last 100 were
delivered correctly.

This is the excerpt from my .mailfilter.log:

Date: Wed Dec 13 11:34:34 2017
From: 
Subj: 
File: /home/mr/Maildir                                                   (221)

Date: Wed Dec 13 11:34:35 2017
From: 
Subj: 
File: /home/mr/Maildir                                                   (228)

(and all the 144 first msgs like that, the last 100 were fine)

And any more info that might still be missing, unless I am prevented to do so
by more attacks, I will gladly provide.

What happened. How was Maldrop (and Getmail) tricked into accepting so badly
truncated mail with no content, no subject, no sender, no from, and delete it
on the server?

And how to protect oneself from such attacks?

Regards!

-- 
Miroslav Rovis
Zagreb, Croatia
https://www.CroatiaFidelis.hr

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot

_______________________________________________
Courier-maildrop mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/courier-maildrop
signature.asc (application/pgp-signature, 833 B)