Embedded Graphics replaced with [IMAGE] within eamils.

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ASKER

Hemanth

The contents of the $MimeTrack field are:

Field Name: $MIMETrack
Data Type: Text List
Data Length: 255 bytes
Seq Num: 1
Dup Item ID: 0
Field Flags: SUMMARY

"Itemize by SMTP Server on alsco_pym/ALSCO2(Release 6.0.3|September 26, 2003) at 11/25/2003 08:08:02 AM"
"MIME-CD by Notes Server on alsco_pym/ALSCO2(Release 6.0.3|September 26, 2003) at 11/25/2003 08:08:03 AM"
"MIME-CD complete at 11/25/2003 08:08:04 AM"

Not sure if that helps any.

What is PGP?

This problem is happening to all users on the server.

We have tried uninstalling the anti-virus software but that did not help.

I have already been to the two links that you supplied but will revisit them to check that I haven't missed anything.

This happens during partial converions. The conversons would be MIME to text or MIME to ruch text.

MINE messages can embed an image using multipart MIME, or by referencing an image on the web. If the MIME content is stored as MIME, no conversion takes place, and when the message loads, the image is retrieved from either the messageitself (multipart) or the web.

I believe when converting a message to text, all images are replaced with an [IMAGE] marker. When converting to "CD" (Notes rich text format), I believe embedded images are retained (those obtained from the mltipart MIME message itself), but an image that would have been retrieved form the internet by the lcient is just replaced by the [IMAGE] tag.

n your case, you probably have "prefers rich text" in your person document. You should set no preference, so that MIME conntent remains MIME content... unless you have security issues.

ASKER

Thanks but I have tried changing the format preference to both "no preference" & "prefers MIME" but neither have the desired effect????

Are ****ALL**** of your servers R6?

Are your clients R6?

Can you have one of the "problem messages" also sent BY THE ORIGINAL SENDER to a "public" POP3 account, that you can retrieve it from? Please postthe full MIEM content.

ASKER

The domino server that receives the internet mail has been recently upgraded from R5 to R6. The problem was occurring in R5. We have only three R6 clients, again recently upgraded from R5, while the reat are R5. The problem is occurring on all clients.

I sent one of the problem messages to my home internet POP account & when opened it had a "html" attachment. This attachment opened up fine in Internet Explorer.

Below is the header information from the email. If you need the full email html content has well I could post it but it is quite long.

X-BRODCASTDATE: November 20, 2003
From <WatchGuard_LiveSecurity@tailorednews.com> Friday, 21 November 2003, 06:20:59
X-TMZI: 1564795
Content-Transfer-Encoding: quoted-printable
Reply-To: WatchGuard_LiveSecurity@tailorednews.com
Received: from mail pickup service by tailorednews.com with Microsoft SMTPSVC;
Thu, 20 Nov 2003 11:34:13 -0800
MIME-Version: 1.0
Return-Path: <WatchGuard_LiveSecurity@tailorednews.com>
X-Mailer: TM 3.0 for Windows
From: "WatchGuard LiveSecurity" <WatchGuard_LiveSecurity@tailorednews.com>
X-MSGTO: tledger@alsco.com.au
Content-Type: text/html; charset="iso-8859-1"
To: "Terry Ledger" <tledger@alsco.com.au>
Message-ID: <KOSMOMYTcecyvfBT5zk0001bbae@tailorednews.com>
X-TMNID: 352
X-OriginalArrivalTime: 20 Nov 2003 19:34:13.0640 (UTC) FILETIME=[473CD080:01C3AF9D]
Date: 20 Nov 2003 11:34:13 -0800
Subject: LiveSecurity | Urgent: Macintosh OS X Security Update
X-Envelope-To: <tledger@alsco.com.au>

It is the MIME content that I am looking to see, not the SMTP headers. I would like to see the full MIME content from an IDENTICALLY SENT message, from both the "home" account copy and the Notes copy. (The notes MIME content is a little harder to get. The easiest way is to enable POP3, and use telnet to retrieve the specific message. Do the same for teh home account.)

If length is an issue, and you can get the problem pretty consistently repeated with e-Mail you create yourself, then try creating a very short message with a very small GIF, e.g., a single-pixel GIF.

One of the above links should give you some soln to this problem.. Carefully go thru the documentation and see all your config values abide with the note.

Also try setting your Internet Browser option in the location doc to Internet explorer or notes with internet explorer. And then restart notes and open the mail again.

Also look into local log file for any error msgs that might have recorded while opening the mail with [image] tags

ASKER

qwaletee

Here is the full content of the email. This is the notes copy. Not sure how to get it from the home copy.

Hope this helps.

Received: from ln-server-pym.alsco.com.au ([127.0.0.1])
by alsco_pym.alsco.com.au (Lotus Domino Release 6.0.3)
with ESMTP id 2003112708341636-56 ;
Thu, 27 Nov 2003 08:34:16 +1100
Received: from Unknown [207.115.66.190] by ln-server-pym.alsco.com.au - SuperScout Email Filter ; Friday, 21 November 2003, 06:20:59
Received: from mail pickup service by tailorednews.com with Microsoft SMTPSVC;
       Thu, 20 Nov 2003 11:34:13 -0800
Message-ID: <KOSMOMYTcecyvfBT5zk0001bbae@tailorednews.com>
From: "WatchGuard LiveSecurity" <WatchGuard_LiveSecurity@tailorednews.com>
To: "Terry Ledger" <tledger@alsco.com.au>
Date: Thu, 27 Nov 2003 08:34:15 +1000
Subject: Fwd: LiveSecurity | Urgent: Macintosh OS X Security Update
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Message Admin
X-TMNID: 352
X-TMZI: 1564795
X-MSGTO: tledger@alsco.com.au
X-BRODCASTDATE: November 20, 2003
X-OriginalArrivalTime: 20 Nov 2003 19:34:13.0640 (UTC) FILETIME=[473CD080:01C3AF9D]
Reply-To: WatchGuard_LiveSecurity@tailorednews.com

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>

<head><title>LiveSecurity | Urgent: Macintosh OS X Security Update</title><=
style type=3D"text/css">

</style></head>
<body><DIV align=3D"center"><TABLE border=3D"0" cellPadding=3D"0" cellSpaci=
ng=3D"0" width=3D"600" bgcolor=3D"#FFFFFF"> <TR><TD bgcolor =3D "#ffffff"><=
TABLE border=3D"0" cellPadding=3D"0" cellSpacing=3D"0" width=3D"600"><TR><T=
D> <img src=3D"http://tailorednews.com/WatchGuard/LiveSecurity/Images/LSSbc=
astHeadurgent.gif" height=3D"111" width=3D"602"></TD></TR></TABLE></TD></TR=
>
<TR><TD><TABLE border=3D"0" cellPadding=3D"0" cellSpacing=3D"1" width=3D"60=
0" bgcolor=3D"#dddddd"><TR><TD width =3D "174" bgcolor=3D"#ffffff" valign=3D=
"top"><TABLE border=3D"0" cellPadding=3D"0" cellSpacing=3D"0" width=3D"174"=
><TR><TD bgcolor =3D "#ffffff"><TABLE border=3D"0" cellPadding=3D"0" cellSp=
acing=3D"0" width=3D"174"><TR><TD> <H4><IMG src=3D"http://tailorednews.com/=
watchguard/livesecurity/images/LSSsysadmin.jpg"> <BR><BR></H4>
<TABLE cellSpacing=3D0 cellPadding=3D0 width=3D174 bgColor=3D#cccccc border=
=3D0>
<TBODY>
<TR>
<TD bgColor=3D#ffffff> </TD>
<TD class=3Dsubtitle2 bgColor=3D#ffffff>Unseen Security Gaps?</TD>
<TD bgColor=3D#ffffff></TD></TR>
<TR>
<TD bgColor=3D#ffffff> </TD>
<TD class=3Dgray bgColor=3D#ffffff>Scan, find and terminate them! <A href=3D=
"http://www.watchguard.com/products/auditscan.asp"><STRONG>Learn how</STRON=
G></A>.</TD>
<TD bgColor=3D#ffffff></TD></TR>
<TR>
<TD width=3D9 bgColor=3D#ffffff><IMG height=3D2 alt=3D"" hspace=3D0 src=3D"=
http://tailoredmail.com/images/space.gif" width=3D9 border=3D0></TD>
<TD width=3D150 bgColor=3D#ffffff><A href=3D"http://www.watchguard.com/arch=
ive/qcampaign.asp?LSID=3DVAABOUT&MSID=3D28&qurl=3Dhttps://freescan.=
qualys.com" ALT?BUY NOW, OFF OF $50 one year Unlimited Scanning, Offer Ends=
Soon!><IMG height=3D100 alt=3D"" src=3D"http://tailorednews.com/watchguard=
/livesecurity/images/AS_buynow5.gif" vspace=3D8 border=3D0></A></TD>
<TD width=3D1 bgColor=3D#ffffff></TD></TR></TBODY></TABLE></TD></TR></TABLE=
></TD></TR>
</TABLE></TD>
<TD width =3D "426" bgcolor=3D"#ffffff" valign=3D"top"><TABLE border=3D"0" =
cellPadding=3D"0" cellSpacing=3D"0" width=3D"426"><tr><td><TABLE border=3D"=
0" cellPadding=3D"10" cellSpacing=3D"0" width=3D"426" bgcolor=3D"#ffffff"><=
TR><TD><a name=3D"7122"> </a><H1>OS X Security Update 11/20:</H1>
<H1>Multiple Security Flaws in OS X Open Source Software</H1>
<H3>Severity: Medium</H3>
<P>20 November 2003</P>
<H3>Summary<B>:</B> </H3>
<P>Yesterday, Apple announced security updates for Mac OS 10.2.8 and 10.3.1=
(OS X). These updates fix vulnerabilities in various applications that shi=
p with OS X, including open source packages such as OpenSSL. Apple's adviso=
ry does not detail the impact of each vulnerability. Administrators of Maci=
ntosh OS X computers should download, test, and install the appropriat=
e update as soon as practical.</P>
<H3>Exposure:</H3>
<P>OS X (Apple's latest operating system) has switched to a Unix BSD-like c=
ore system. With this change, the operating system now includes many useful=
open-source applications and libraries, such as OpenSSH. However, these op=
en-source packages also bring with them their security vulnerabilities.</P>
<P>Yesterday, Apple released updates that fix various vulnerabilities, many=
open-source related, in Mac OS 10.2.8 and 10.3.1. Apple does not describe =
the vulnerabilities or impacts in great detail. However, we believe the fla=
ws have the same impact on an OS X system as they would upon any other Unix=
-like system, so we assess the various impacts as follows. </P>
<UL>
<LI><B>An <A href=3D"http://www.watchguard.com/glossary/e.asp#elevation">El=
evation of Privilege</A> flaw in the gm4</B> utility could allow local user=
s to gain root access. <I>(Only affects 10.2.8)</I></LI>
<LI><B>A Format String vulnerability in groff </B>could allow remote users =
to execute code with unspecified privileges.<I> (Only affects 10.2.8)</I></=
LI>
<LI><B>A flaw in OS X's Mail application</B> may allow plain text logins wh=
en MD5 Challenge Response logins are used. <I>(Only affects 10.2.8)</I></LI=
>
<LI><B>An Elevation of Privilege flaw in the Personal File Sharing</B> feat=
ure could allow local users to gain root access. <I>(Only affects 10.2.8)</=
I></LI>
<LI><B>A Quicktime for Java vulnerability</B> could allow remote attackers =
to access your system. <I>(Only affects 10.2.8)</I></LI>
<LI><B>An ASN.1 parsing flaw in OpenSSL</B> could result in a <A href=3D"ht=
tp://www.watchguard.com/glossary/d.asp#dos">Denial of Service(DoS)</A>. We =
described this flaw in our September 30, <A href=3D"https://www.watchguard.=
com/archive/showhtml.asp?pack=3D6128">Information Alert</A>.</LI>
<LI><B>A <A href=3D"http://www.watchguard.com/glossary/b.asp#buffer_overflo=
w">buffer overflow</A> in a zlib function </B>[gzprintf()] could allow atta=
ckers to cause a DoS or execute unauthorized code.</LI></UL>
<H3>Solution Path:</H3>
<P>Apple has released patches for both OS 10.2.8 and 10.3.1. OS X administr=
ators should download, test, and install the appropriate patch as soon as p=
ractical:</P>
<UL>
<LI><A href=3D"http://www.info.apple.com/kbnum/n120277">OS X 11/19 Security=
Update for 10.2.8</A></LI>
<LI><A href=3D"http://www.info.apple.com/kbnum/n120278">OS X 11/19 Security=
Update for 10.3.1</A></LI></UL>
<P><B>For WatchGuard SOHO, Firebox, and Vclass Users:<BR></B>Since many of =
these flaws are either exploited locally, or via services you must allow fo=
r Web access, the patches above are your primary recourse.</P>
<H3>Status:</H3>
<P>Apple has released patches.</P>
<H3 style=3D"MARGIN-BOTTOM: 0px"><FONT color=3D#000000>References:</FONT></=
H3>
<P style=3D"MARGIN-BOTTOM: 0px"><A href=3D"http://lists.apple.com/mhonarc/s=
ecurity-announce/msg00041.html">Apple 11/19 Security Announcement</A> (requ=
ires log-in; type "archives" for both username and password.)</P>
<P style=3D"MARGIN-BOTTOM: 0px"><FONT color=3D#000000 size=3D1>This alert w=
as researched and written by Corey Nachreiner.</FONT></P>
<HR>

<P><FONT color=3D#808080>Did this alert help you? How could we improve it? =
<BR>Let us know at </FONT><FONT color=3D#008080><A href=3D"mailto:lsseditor=
@watchguard.com?subject=3DMac OS X patch">lsseditor@watchguard.com</A>.</FO=
NT></P>
<P><FONT color=3D#808080>For past alerts, log into the</FONT><FONT color=3D=
#008080> <A href=3D"https://www3.watchguard.com/archive/broadcasts.asp">Liv=
eSecurity Archive</A>.</FONT></P>
<P><FONT color=3D#808080>Jargon defined in the</FONT><FONT color=3D#008080>=
<A href=3D"http://www.watchguard.com/glossary">LiveSecurity Online Glossar=
y</A>.</FONT></P></td></tr><tr><td height=3D"10"> </td></tr>
</table></td></tr>
<TR><TD bgcolor =3D "#ffffff"><TABLE border=3D"0" cellPadding=3D"0" cellSpa=
cing=3D"0" width=3D"426"><TR><TD> <TABLE cellSpacing=3D0 cellPadding=3D8 bo=
rder=3D0>
<TBODY>
<TR>
<TD>
<HR SIZE=3D1>
<FONT face=3Dgeneva,verdana,arial,helvetica color=3D#666666 size=3D1><B>NOT=
E:</B><BR>This e-mail was sent from an unattended mailbox. Please do not re=
ply.</FONT></TD></TR>
<TR>
<TD><FONT face=3Dgeneva,verdana,arial,helvetica color=3D#666666 size=3D1><B=
>ABOUT Questiva/TailoredMail:</B><BR>WatchGuard has contracted with Questiv=
a/TailoredMail, an industry leading vendor of trusted email services, to se=
nd these emails and maintain a record of your preferences confidentially. P=
ersonal information about you is not sold or rented to Questiva/TailoredMai=
l or to other companies. Both WatchGuard and Questiva/TailoredMail are full=
y committed to your privacy, as detailed in WatchGuard's <A href=3D"http://=
www.watchguard.com/about/privacy.asp"><FONT color=3D#990000>privacy policy<=
/FONT></A>.</FONT></TD></TR>
<TR>
<TD><FONT face=3Dgeneva,verdana,arial,helvetica color=3D#666666 size=3D1><B=
>TO UNSUBSCRIBE:</B><BR>You received this e-mail because you subscribed to =
the WatchGuard LiveSecurity Service, which advises about virus alerts, secu=
rity best practices, new hacking exploits, and more. If you no longer wish =
to be advised of these things, please let us know: <A href=3D"https://www.w=
atchguard.com/archive/preferences.asp" target=3D_blank><FONT color=3D#99000=
0>Unsubscribe</FONT></A>.</FONT></TD></TR>
<TR>
<TD><FONT face=3Dgeneva,verdana,arial,helvetica color=3D#666666 size=3D1>Co=
pyright 2003 WatchGuard Technologies, Incorporated. All Rights Reserved. Wa=
tchGuard, LiveSecurity, Firebox, and any other word listed as a trademark i=
n the <A href=3D"http://www.watchguard.com/legal.asp">"Terms of Use"</A> po=
rtion of the WatchGuard Web site that is used herein, are registered tradem=
arks or trademarks of WatchGuard Technologies, Inc. in the United States an=
d/or other countries. All other trademarks are the property of their respec=
tive owners. <I>You may not modify, reproduce, republish, post, transmit, o=
r distribute this content except as expressly permitted in writing by Watch=
Guard Technologies, Inc</I></FONT></TD></TR></TBODY></TABLE></TD></TR></TABLE></TD></TR>
</TABLE></TD>
</TR></TABLE></TD></TR>
<TR><TD bgcolor =3D "#ffffff"><TABLE border=3D"0" cellPadding=3D"0" cellSpa=
cing=3D"0" width=3D"600"><TR><TD> 
<table cellpadding=3D"0" cellspacing=3D"0" border=3D"0"=
>
<tr>
<td bgcolor=3D"#808080" width=3D"175"><img src=3D"h=
ttp://tailoredmail.com/images/space.gif" height=3D"1" width=3D"175" hspace=3D=
"0" vspace=3D"0" border=3D"0" alt=3D""></td>
<td width=3D"428" bgcolor=3D"#000000"><img src=3D"h=
ttp://tailoredmail.com/images/space.gif" height=3D"1" width=3D"428" hspace=3D=
"0" vspace=3D"0" border=3D"0" alt=3D""></td>
</tr>
<tr>
<td bgcolor=3D"#D8E0E2" width=3D"175"><img src=3D"h=
ttp://tailoredmail.com/images/space.gif" height=3D"1" width=3D"175" hspace=3D=
"0" vspace=3D"0" border=3D"0" alt=3D""></td>
<td width=3D"428" bgcolor=3D"#CCCCCC">=20
<table cellpadding=3D"3" cellspacing=3D"0" bord=
er=3D"0" width=3D"100%">
<tr>
<td><img src=3D"http://tailoredmail.com/ima=
ges/space.gif" height=3D"1" width=3D"1"></td>
<td><font face=3D"Verdana" size=3D"1">Copyr=
ight =A9 1996 - 2003 WatchGuard Technologies, Inc. <br>All rights rese=
rved.    |    <a href=3D"http://www=
=2Ewatchguard.com/legal.asp" target=3D"_blank"><font color=3D"#990000"><b>T=
erms of Use</b></font></a></font></td>
</tr>
</table>
</td>
</tr>
<tr>
<td bgcolor=3D"#808080" width=3D"175"><img src=3D"h=
ttp://tailoredmail.com/images/space.gif" height=3D"1" width=3D"175" hspace=3D=
"0" vspace=3D"0" border=3D"0" alt=3D""></td>
<td width=3D"428" bgcolor=3D"#000000"><img src=3D"h=
ttp://tailoredmail.com/images/space.gif" height=3D"1" width=3D"428" border=3D=
"0" alt=3D""></td>
</tr>
</table>
<br>
</TD></TR></TABLE></TD></TR>
</TABLE></DIV>
<style type=3D"text/css">

</style></body></html>

Received: from ln-server-pym.alsco.com.au ([127.0.0.1])
by alsco_pym.alsco.com.au (Lotus Domino Release 6.0.3)
with ESMTP id 2003112708341636-56 ;
Thu, 27 Nov 2003 08:34:16 +1100
Received: from Unknown [207.115.66.190] by ln-server-pym.alsco.com.au - SuperScout Email Filter ; Friday, 21 November 2003, 06:20:59
Received: from mail pickup service by tailorednews.com with Microsoft SMTPSVC;
       Thu, 20 Nov 2003 11:34:13 -0800
Message-ID: <KOSMOMYTcecyvfBT5zk0001bbae@tailorednews.com>
From: "WatchGuard LiveSecurity" <WatchGuard_LiveSecurity@tailorednews.com>
To: "Terry Ledger" <tledger@alsco.com.au>
Date: Thu, 27 Nov 2003 08:34:15 +1000
Subject: Fwd: LiveSecurity | Urgent: Macintosh OS X Security Update
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Message Admin
X-TMNID: 352
X-TMZI: 1564795
X-MSGTO: tledger@alsco.com.au
X-BRODCASTDATE: November 20, 2003
X-OriginalArrivalTime: 20 Nov 2003 19:34:13.0640 (UTC) FILETIME=[473CD080:01C3AF9D]
Reply-To: WatchGuard_LiveSecurity@tailorednews.com

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>

<head><title>LiveSecurity | Urgent: Macintosh OS X Security Update</title><=
style type=3D"text/css">

</style></head>
<body><DIV align=3D"center"><TABLE border=3D"0" cellPadding=3D"0" cellSpaci=
ng=3D"0" width=3D"600" bgcolor=3D"#FFFFFF"> <TR><TD bgcolor =3D "#ffffff"><=
TABLE border=3D"0" cellPadding=3D"0" cellSpacing=3D"0" width=3D"600"><TR><T=
D> <img src=3D"http://tailorednews.com/WatchGuard/LiveSecurity/Images/LSSbc=
astHeadurgent.gif" height=3D"111" width=3D"602"></TD></TR></TABLE></TD></TR=
>
<TR><TD><TABLE border=3D"0" cellPadding=3D"0" cellSpacing=3D"1" width=3D"60=
0" bgcolor=3D"#dddddd"><TR><TD width =3D "174" bgcolor=3D"#ffffff" valign=3D=
"top"><TABLE border=3D"0" cellPadding=3D"0" cellSpacing=3D"0" width=3D"174"=
><TR><TD bgcolor =3D "#ffffff"><TABLE border=3D"0" cellPadding=3D"0" cellSp=
acing=3D"0" width=3D"174"><TR><TD> <H4><IMG src=3D"http://tailorednews.com/=
watchguard/livesecurity/images/LSSsysadmin.jpg"> <BR><BR></H4>
<TABLE cellSpacing=3D0 cellPadding=3D0 width=3D174 bgColor=3D#cccccc border=
=3D0>
<TBODY>
<TR>
<TD bgColor=3D#ffffff> </TD>
<TD class=3Dsubtitle2 bgColor=3D#ffffff>Unseen Security Gaps?</TD>
<TD bgColor=3D#ffffff></TD></TR>
<TR>
<TD bgColor=3D#ffffff> </TD>
<TD class=3Dgray bgColor=3D#ffffff>Scan, find and terminate them! <A href=3D=
"http://www.watchguard.com/products/auditscan.asp"><STRONG>Learn how</STRON=
G></A>.</TD>
<TD bgColor=3D#ffffff></TD></TR>
<TR>
<TD width=3D9 bgColor=3D#ffffff><IMG height=3D2 alt=3D"" hspace=3D0 src=3D"=
http://tailoredmail.com/images/space.gif" width=3D9 border=3D0></TD>
<TD width=3D150 bgColor=3D#ffffff><A href=3D"http://www.watchguard.com/arch=
ive/qcampaign.asp?LSID=3DVAABOUT&MSID=3D28&qurl=3Dhttps://freescan.=
qualys.com" ALT?BUY NOW, OFF OF $50 one year Unlimited Scanning, Offer Ends=
Soon!><IMG height=3D100 alt=3D"" src=3D"http://tailorednews.com/watchguard=
/livesecurity/images/AS_buynow5.gif" vspace=3D8 border=3D0></A></TD>
<TD width=3D1 bgColor=3D#ffffff></TD></TR></TBODY></TABLE></TD></TR></TABLE=
></TD></TR>
</TABLE></TD>
<TD width =3D "426" bgcolor=3D"#ffffff" valign=3D"top"><TABLE border=3D"0" =
cellPadding=3D"0" cellSpacing=3D"0" width=3D"426"><tr><td><TABLE border=3D"=
0" cellPadding=3D"10" cellSpacing=3D"0" width=3D"426" bgcolor=3D"#ffffff"><=
TR><TD><a name=3D"7122"> </a><H1>OS X Security Update 11/20:</H1>
<H1>Multiple Security Flaws in OS X Open Source Software</H1>
<H3>Severity: Medium</H3>
<P>20 November 2003</P>
<H3>Summary<B>:</B> </H3>
<P>Yesterday, Apple announced security updates for Mac OS 10.2.8 and 10.3.1=
(OS X). These updates fix vulnerabilities in various applications that shi=
p with OS X, including open source packages such as OpenSSL. Apple's adviso=
ry does not detail the impact of each vulnerability. Administrators of Maci=
ntosh OS X computers should download, test, and install the appropriat=
e update as soon as practical.</P>
<H3>Exposure:</H3>
<P>OS X (Apple's latest operating system) has switched to a Unix BSD-like c=
ore system. With this change, the operating system now includes many useful=
open-source applications and libraries, such as OpenSSH. However, these op=
en-source packages also bring with them their security vulnerabilities.</P>
<P>Yesterday, Apple released updates that fix various vulnerabilities, many=
open-source related, in Mac OS 10.2.8 and 10.3.1. Apple does not describe =
the vulnerabilities or impacts in great detail. However, we believe the fla=
ws have the same impact on an OS X system as they would upon any other Unix=
-like system, so we assess the various impacts as follows. </P>
<UL>
<LI><B>An <A href=3D"http://www.watchguard.com/glossary/e.asp#elevation">El=
evation of Privilege</A> flaw in the gm4</B> utility could allow local user=
s to gain root access. <I>(Only affects 10.2.8)</I></LI>
<LI><B>A Format String vulnerability in groff </B>could allow remote users =
to execute code with unspecified privileges.<I> (Only affects 10.2.8)</I></=
LI>
<LI><B>A flaw in OS X's Mail application</B> may allow plain text logins wh=
en MD5 Challenge Response logins are used. <I>(Only affects 10.2.8)</I></LI=
>
<LI><B>An Elevation of Privilege flaw in the Personal File Sharing</B> feat=
ure could allow local users to gain root access. <I>(Only affects 10.2.8)</=
I></LI>
<LI><B>A Quicktime for Java vulnerability</B> could allow remote attackers =
to access your system. <I>(Only affects 10.2.8)</I></LI>
<LI><B>An ASN.1 parsing flaw in OpenSSL</B> could result in a <A href=3D"ht=
tp://www.watchguard.com/glossary/d.asp#dos">Denial of Service(DoS)</A>. We =
described this flaw in our September 30, <A href=3D"https://www.watchguard.=
com/archive/showhtml.asp?pack=3D6128">Information Alert</A>.</LI>
<LI><B>A <A href=3D"http://www.watchguard.com/glossary/b.asp#buffer_overflo=
w">buffer overflow</A> in a zlib function </B>[gzprintf()] could allow atta=
ckers to cause a DoS or execute unauthorized code.</LI></UL>
<H3>Solution Path:</H3>
<P>Apple has released patches for both OS 10.2.8 and 10.3.1. OS X administr=
ators should download, test, and install the appropriate patch as soon as p=
ractical:</P>
<UL>
<LI><A href=3D"http://www.info.apple.com/kbnum/n120277">OS X 11/19 Security=
Update for 10.2.8</A></LI>
<LI><A href=3D"http://www.info.apple.com/kbnum/n120278">OS X 11/19 Security=
Update for 10.3.1</A></LI></UL>
<P><B>For WatchGuard SOHO, Firebox, and Vclass Users:<BR></B>Since many of =
these flaws are either exploited locally, or via services you must allow fo=
r Web access, the patches above are your primary recourse.</P>
<H3>Status:</H3>
<P>Apple has released patches.</P>
<H3 style=3D"MARGIN-BOTTOM: 0px"><FONT color=3D#000000>References:</FONT></=
H3>
<P style=3D"MARGIN-BOTTOM: 0px"><A href=3D"http://lists.apple.com/mhonarc/s=
ecurity-announce/msg00041.html">Apple 11/19 Security Announcement</A> (requ=
ires log-in; type "archives" for both username and password.)</P>
<P style=3D"MARGIN-BOTTOM: 0px"><FONT color=3D#000000 size=3D1>This alert w=
as researched and written by Corey Nachreiner.</FONT></P>
<HR>

<P><FONT color=3D#808080>Did this alert help you? How could we improve it? =
<BR>Let us know at </FONT><FONT color=3D#008080><A href=3D"mailto:lsseditor=
@watchguard.com?subject=3DMac OS X patch">lsseditor@watchguard.com</A>.</FO=
NT></P>
<P><FONT color=3D#808080>For past alerts, log into the</FONT><FONT color=3D=
#008080> <A href=3D"https://www3.watchguard.com/archive/broadcasts.asp">Liv=
eSecurity Archive</A>.</FONT></P>
<P><FONT color=3D#808080>Jargon defined in the</FONT><FONT color=3D#008080>=
<A href=3D"http://www.watchguard.com/glossary">LiveSecurity Online Glossar=
y</A>.</FONT></P></td></tr><tr><td height=3D"10"> </td></tr>
</table></td></tr>
<TR><TD bgcolor =3D "#ffffff"><TABLE border=3D"0" cellPadding=3D"0" cellSpa=
cing=3D"0" width=3D"426"><TR><TD> <TABLE cellSpacing=3D0 cellPadding=3D8 bo=
rder=3D0>
<TBODY>
<TR>
<TD>
<HR SIZE=3D1>
<FONT face=3Dgeneva,verdana,arial,helvetica color=3D#666666 size=3D1><B>NOT=
E:</B><BR>This e-mail was sent from an unattended mailbox. Please do not re=
ply.</FONT></TD></TR>
<TR>
<TD><FONT face=3Dgeneva,verdana,arial,helvetica color=3D#666666 size=3D1><B=
>ABOUT Questiva/TailoredMail:</B><BR>WatchGuard has contracted with Questiv=
a/TailoredMail, an industry leading vendor of trusted email services, to se=
nd these emails and maintain a record of your preferences confidentially. P=
ersonal information about you is not sold or rented to Questiva/TailoredMai=
l or to other companies. Both WatchGuard and Questiva/TailoredMail are full=
y committed to your privacy, as detailed in WatchGuard's <A href=3D"http://=
www.watchguard.com/about/privacy.asp"><FONT color=3D#990000>privacy policy<=
/FONT></A>.</FONT></TD></TR>
<TR>
<TD><FONT face=3Dgeneva,verdana,arial,helvetica color=3D#666666 size=3D1><B=
>TO UNSUBSCRIBE:</B><BR>You received this e-mail because you subscribed to =
the WatchGuard LiveSecurity Service, which advises about virus alerts, secu=
rity best practices, new hacking exploits, and more. If you no longer wish =
to be advised of these things, please let us know: <A href=3D"https://www.w=
atchguard.com/archive/preferences.asp" target=3D_blank><FONT color=3D#99000=
0>Unsubscribe</FONT></A>.</FONT></TD></TR>
<TR>
<TD><FONT face=3Dgeneva,verdana,arial,helvetica color=3D#666666 size=3D1>Co=
pyright 2003 WatchGuard Technologies, Incorporated. All Rights Reserved. Wa=
tchGuard, LiveSecurity, Firebox, and any other word listed as a trademark i=
n the <A href=3D"http://www.watchguard.com/legal.asp">"Terms of Use"</A> po=
rtion of the WatchGuard Web site that is used herein, are registered tradem=
arks or trademarks of WatchGuard Technologies, Inc. in the United States an=
d/or other countries. All other trademarks are the property of their respec=
tive owners. <I>You may not modify, reproduce, republish, post, transmit, o=
r distribute this content except as expressly permitted in writing by Watch=
Guard Technologies, Inc</I></FONT></TD></TR></TBODY></TABLE></TD></TR></TABLE></TD></TR>
</TABLE></TD>
</TR></TABLE></TD></TR>
<TR><TD bgcolor =3D "#ffffff"><TABLE border=3D"0" cellPadding=3D"0" cellSpa=
cing=3D"0" width=3D"600"><TR><TD> 
<table cellpadding=3D"0" cellspacing=3D"0" border=3D"0"=
>
<tr>
<td bgcolor=3D"#808080" width=3D"175"><img src=3D"h=
ttp://tailoredmail.com/images/space.gif" height=3D"1" width=3D"175" hspace=3D=
"0" vspace=3D"0" border=3D"0" alt=3D""></td>
<td width=3D"428" bgcolor=3D"#000000"><img src=3D"h=
ttp://tailoredmail.com/images/space.gif" height=3D"1" width=3D"428" hspace=3D=
"0" vspace=3D"0" border=3D"0" alt=3D""></td>
</tr>
<tr>
<td bgcolor=3D"#D8E0E2" width=3D"175"><img src=3D"h=
ttp://tailoredmail.com/images/space.gif" height=3D"1" width=3D"175" hspace=3D=
"0" vspace=3D"0" border=3D"0" alt=3D""></td>
<td width=3D"428" bgcolor=3D"#CCCCCC">=20
<table cellpadding=3D"3" cellspacing=3D"0" bord=
er=3D"0" width=3D"100%">
<tr>
<td><img src=3D"http://tailoredmail.com/ima=
ges/space.gif" height=3D"1" width=3D"1"></td>
<td><font face=3D"Verdana" size=3D"1">Copyr=
ight =A9 1996 - 2003 WatchGuard Technologies, Inc. <br>All rights rese=
rved.    |    <a href=3D"http://www=
=2Ewatchguard.com/legal.asp" target=3D"_blank"><font color=3D"#990000"><b>T=
erms of Use</b></font></a></font></td>
</tr>
</table>
</td>
</tr>
<tr>
<td bgcolor=3D"#808080" width=3D"175"><img src=3D"h=
ttp://tailoredmail.com/images/space.gif" height=3D"1" width=3D"175" hspace=3D=
"0" vspace=3D"0" border=3D"0" alt=3D""></td>
<td width=3D"428" bgcolor=3D"#000000"><img src=3D"h=
ttp://tailoredmail.com/images/space.gif" height=3D"1" width=3D"428" border=3D=
"0" alt=3D""></td>
</tr>
</table>
<br>
</TD></TR></TABLE></TD></TR>
</TABLE></DIV>
<style type=3D"text/css">

</style></body></html>

ASKER

HermanthaKumar

I have been through the recommendations from the links & everything seems in order.

My browser has always been set to Internet Explorer & I can't find any reference in the log files.

What I can't understand is that no matter what my personal inbound settings are set at, "Prefers MIME, No Preference or Rich Text", the router will always convert the message from MIME to CD as per the $MIMETrack field. According to the documentation that I have read, if "Prefers MIME or No Preference" is set, the router should not do the conversion & store the message as MIME.

Do you agree & if so why is the router ignoring those settings.

tjledger,
Do you have exactly ONE Domino server? Or are there others?

What I also find interesting is that even though you say this message came into your mailbox as CD instead of MIME, and even though you say you get [IMAGE] placeholders -- nevertheless, I see HTML content with lots of IMG SRC entries. The only odd thing is the quoted-printable tags, like =3D, which is ASCII 61, which is the equal sign. So, yes, something is getting mangled. When you have an image in HTML, it should say <IMG SRC="url">. If it says <IMG SRC=3D"url"> then you don't have a source URL, and teh image can't be loaded, which is why you might get placeholders (though I would think you wold get the litle red X graphics instead).

Usually, when I see something like this, there is some sort of character set issue. This is coming in as iso-8859-1, which I would not normally expect a problem from. But you might try changing your router chacater set options, and see what happens. (I believe that requires both an SMTP restart and a router restart).

madheeswar

In the person document, Format preference Incoming Mail to MIME

Still if you are facing the same problem , in the server notes.ini
enter parameter
      MIME_CONVERT_HTML_TO_ATTACHMENT=1

Else check the Technote from Lotus: 182419

The above is for R5 Server.

https://www.experts-exchange.com/questions/20387010/Receiving-HTML-Newletters-in-Lotus-Notes.html

It may help.

ASKER

Qwaletee

We have several domino servers in our network but the server in question is the primary domino server & all internet email is routed through it.

The router character set option is set to iso-8859-1.

ASKER

madheeswar

Changing the format preference in the person document does not seem to have any affect. No matter what that is set to according to the $MIMEtrack field in the document properties the server is still converting the message from MIME to CD. This, according to the documentation that I have read, should not happen if the the preference is "Prefers MIME".

Adding the "MIME_CONVERT_HTML_TO_ATTACHMENT=1" to the notes.ini file does give us a work around.

All incoming internet mail now has a "C.htm" attachment that when opened can be viewed correctly in Internet Explorer.

But I would still prefer to have notes working correctly, has it has done in the past.

Any further suggestions?

madheeswar

MIME_CONVERT_HTML_TO_ATTACHMENT=1

The above will do the trick for V5. For ND6, thier should not be a problem, as Notes promised to resolve that issue from ND6.

For R5, it is not resolved till now. Don't expect more than this. It is a bug in Notes R5.

Let us wait, if other Experts have any solutions.

-Thanks.

tjledger,
> We have several domino servers in our network but the server in question is
> the primary domino server & all internet email is routed through it.
What are the version numbers on the other Domino servers?

ASKER

qwaletee

We have 15 other Domino servers in our network & all are release 5.

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Second, I want you to confirm for me that this is your architecture:

Internet
||
||
Domino R6 server (I'll call it "GATEWAY")
||
=============================Domino R5 "SERVER1"
=== Corporate LAN =====
=============================Domino R5 "SERVER2"
|
|-------Domino R5 "SERVERn"
|
\---Domino R5 "Server15"

Finally, I want you to confirm that...

* YOUR mailbox is on the GATEWAY server, in other words, the only DOmino server the example problem messages ever were on is this one R6 server that is conected directly to the internet with no intervening Domino servers, and

* Your person document says "prefers MIME"

* You have eliminated any of those funky MIME conversion settings from the server NOTES.INI and the Server Config docs

Just found this: http://www-1.ibm.com/support/docview.wss?uid=swg21084730

Seems to describe the problem exactly... except that it doesn't. It assumes the problem to be one of a specific way of encoding "internal refernces," where the images are par of the MIME content. Wheras your problem message showed the reference to be external. Personally, I think their knowledge base infomration is wrong, because it glosses over the =3D problem as being "normal for a printed-quaotable messaeg encoding." Bzzzzzzt. Not true. That IS your very problem. Of course, in your case, the =3D was followed by a regular = sign.

WHat I also find interesting, is looking back at the same $MIMETrack field you posted. The original itemization and the later MIME-CD conversion were both performed on teh same server, one second apart -- alsco_pym/ALSCO2. Is that your internet gateway server (Domino SMTP server rececing all inbound internet traffic)? The fact that this server did that indicates one of three things, as per http://www-1.ibm.com/support/docview.wss?uid=swg27002941

1) User has "prefers Notes rich text"
2) Server mail.box uses an old ODS
3) User mail file uses an old ODS

ODS can be found on the second tab of dtabase properties. R5 uses 41, R6 uses 43. Either is fine (both support MIME), but anything older than 41 is a problem. (I think R4 was ODS 20, R3 was 17.)

And my aplogies for repeated separate postings. The first three were deliberately separate, so I could call attention to the three areas I wanted explored. The previous one was an afterthought. And this apology itself was an afterthought!

madheeswar

Qwaletee,
I accept your apologies. I know your concerns.

have a nice day