SMTP MIME null charset
advICE :Intrusions : 2001029

Summary

A malformed MIME header was seen, with an empty charset field. This may indicate an effort to subvert the e-mail server.

Details

MIME introduced some additional complexity into Internet mail processing. In the original Internet mail standard, the data could only be text; however, under MIME, the data could represent graphics, music, text (in any of a variety of languages), and so forth. There had to be a way for the mail to indicate what type of data it contains, directives for the mail server, and so forth. All of this information is conveyed via a special set of data at the start of a mail called MIME Headers.

This detection indicates that the MIME headers contains an empty charset field. An attack may be attempting to break into or crash a system via its SMTP server.

 
Version appeared: 2.5