Subject: [gopher] Re: [Bug 71916] security problem with gopher and
	arbitary ports
From: "Aaron J. Angel" <aangel@myrealbox.com>
To: gopher@complete.org
In-Reply-To: <20020723035709.GC23369@complete.org>
References: <200207222335.g6MNZvl09279@mothra.mozilla.org>
	<20020723010900.GA27682@complete.org>
	<1027387505.16207.19.camel@transa.aquarius.null>
	<20020723035709.GC23369@complete.org>
Content-type: text/plain
Content-Transfer-Encoding: 8bit
Date: 22 Jul 2002 23:11:07 -0500
Message-Id: <1027397468.16207.31.camel@transa.aquarius.null>
Mime-Version: 1.0
Sender: gopher-bounce@complete.org
Errors-to: gopher-bounce@complete.org
Precedence: bulk
Reply-to: gopher@complete.org


> I think you may have missed some of the sarcasm and rhetorical questions in
> my message, so I'll just omit replies to those...

I was agreeing with you, with more rhetorical banter.  (-:

> > The point was Gopher URLs and (ab)using the Gopher protocol can be used
> > to simulate virtually any protocol, including SMTP (read down a little
> > further on the comments, there's an example with SMTP).
> 
> It's pretty trivial to do that with IMAP too, since "GET " forms the
> beginning of any IMAP command.

That's my point, but this is all done with a Gopher URL:

	gopher://imap.server.tld/LOGIN%20user%password%0A%0D...

The argument for this bug, however, is that the following could be used:

	gopher://imap.server.tld/...buffer overflow attack...