Plain Text Options for outbound email must be configured.

From Microsoft Outlook 2010

Part of DTOO228 - Plain Text Options

SV-33505r2_rule Plain Text Options for outbound email must be configured.

Vulnerability discussion

If outgoing mail is formatted in certain ways, for example if attachments are encoded in UUENCODE format, attackers might manipulate the messages for their own purposes. If UUENCODE formatting is used, an attacker could manipulate the encoded attachment to bypass content filtering software.Outlook 2010 automatically wraps plain text messages and uses the standard MIME format to encode attachments in plain text messages. However, these settings can be altered to allow e-mail to be read in plain text e-mail programs that use a non-standard line length or that cannot process MIME attachments.

Check content

The policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2010 -> Outlook Options -> Mail format -> Internet Formatting "Plain text options" must be set to "Enabled" where line length is "132" and that NO Check is visible in the "Encode all attachments in UUENCODE format when sending a plain text message" checkbox option. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\14.0\common\mailsettings Criteria: If the value PlainWrapLen is REG_DWORD = 132 (decimal), this is not a finding. AND HKCU\Software\Policies\Microsoft\Office\14.0\outlook\options\mail Criteria: If the value Message Plain Format Mime is REG_DWORD = 1, this is not a finding.

Fix text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2010 -> Outlook Options -> Mail format -> Internet Formatting "Plain text -> options" to "Enabled" where line length is "132" and that NO Check is visible in the "Encode all attachments in UUENCODE format when sending a plain text message" checkbox option.

Pro Tips

Powered by sagemincer