[Full-Disclosure] Outlook "cid:" handling - Request for Information
1 at malware.com
Sat Oct 16 22:17:35 BST 2004
It has recently come to my attention that it is possible to
circumvent functions inside of Microsoft Outlook 2003 and some
other MUA's by using href tags containing "cid:". By default
such MUAs no longer download web referenced images and objects,
however images referencedby "cid:" strings are embedded (as
attachments with special names) within the e-mail.
Contrary to the policy of not downloading images, it would seem
that these are packaged with the mail (decentralised) AND are
displayed despite non-image download policies.
The download restriction is in refernce to remote files. CID:
is 'content id' it references the content of the appropriate
boundry of the MIME mail message. Which in this case would be an
image. The image is encoded and embedded within the mail message
itself. Not on a remote server and does not /cannot download. It
is a link inside the email to an encoding of the image which is
then rendered. For example:
Simply put it is connecting to the base64 encoded image within
the email message by identifying it with the name malware. As
http is to a webserver, so CID is to the content of the mail
It's not being downloaded from anywhere other than from within
the mail message. However if what you are after is to not view
images, the only way is to accept all email in plain text. But
in Outlook Express [maybe Outlook 2003 haven't checked], an
attached image file even in a plain text message, will be
It is a machine generated CID like this:
This harkens back to the day of the 'slide show' feature in
Outlook Express. But again it is not retrieved remotely, rather
from within the email message itself via the CID.
You may try some sort of filter in Outlook 2003 or definitely on
the server to remedy whatever is concerning you.
Full-Disclosure is hosted and sponsored by Secunia.