[Mimedefang] HTML Exploits

[Philip Prindeville]

David F. Skoll wrote:
> The question becomes: Do you want to implement a full-scale Web
> browser on your scanning machine?  Do you want to spend the CPU
> cycles?  And more to the point, web browsers are complex beasts, so
> any server-based reimplementation is very likely to have its own
> security flaws.  (Server-side implementations are actually much
> harder.  I mean, if a client executes an infinite loop in JavaScript,
> it's not that big a deal.  But if a server hits such a loop while
> trying to render a page...)
>   


I have to agree with David.

Isn't the energy better spent fixing the MUA's, or at least
lighting a fire under the vendor that is shipping the buggy
MUA?

And yes, resoundingly:  the potential for a DoS attack by
causing the "scrubber" in the virus filter to crash while
interpreting the incoming email is non-negligible (for
anyone that doesn't get this, see Mr. Turtle's phonograph
in the book "Godel, Escher, and Bach").

-Philip