Home » Networking » Net_SMTP » Bug #8368

[2006-08-06 07:47 UTC] lucabert at lucabert dot de

Description:
------------
I tryed to use MAIL Package, which use Net_SMTP, to send E-Mails.
I tryed many authentication protocols, and I see that Net_SMTP does not send valid data for AUTH PLAIN.

It sends:

AUTH PLAIN\r\n

and then wants to send the username and password.

But AUTH PLAIN needs to have "\0username\0password\0" (base64 encoded) in the same line of "AUTH PLAIN"...
Net_SMTP have to send a string like:

AUTH PLAIN base64 encoded "\0username\0password\0"

Of course it's not possibile at the moment to use this method.
I know that AUTH PLAIN is not secure, but many SMTP-Servers use it...

Test script:
---------------
<html>
<pre>
<?
require_once('Mail.php');
require_once('Mail/mime.php');

$unames = posix_uname();
$hdrs = array(
'From' => 'Tester <test@server.de>',
'To' => 'test@server.de',
'Subject' => 'Ein kleines Test',
'Message-Id' => '<'.date('YmdHis').'.'.posix_getpid().'@'.$unames[nodename].'>'
);

$mime = new Mail_mime("\n");

$mime->setTXTBody("Mal sehen was es passiert...\nIst nur wegen der Autentifizierung...");
$body = $mime->get();
$hdrs = $mime->headers($hdrs);
$mail =& Mail::factory('smtp', array('host' => 'smtp.server.de', 'auth' => 'PLAIN', 'username' => 'test', 'password' => 'mypassword', 'localhost' => $unames[nodename]));
echo "mail: [";print_r($mail);echo "]<br>\n";
$ret = $mail->send('test@server.de', $hdrs, $body);
echo "ret: [";print_r($ret);echo "]<br>\n";
?>
</pre>
</html>

Expected result:
----------------
The script has to send the E-Mail, after a valid AUTH-PLAIN.
It doesn't... :(

Actual result:
--------------
It does not send any E-Mail.

Error on Server (exim_mainlog):

2006-08-06 09:39:15 fixed_plain authenticator failed for (ns.server.de) [XX.XX.XX.XX]: 535 Incorrect authentication data

Error on Browser (print_r):

mail: [mail_smtp Object
(
[sep] =>

[_smtp] =>
[host] => smtp.server.de
[port] => 25
[auth] => PLAIN
[username] => test
[password] => mypassword
[localhost] => ns.server.de
[timeout] =>
[verp] =>
[debug] =>
[persist] =>
)
]

ret: [pear_error Object
(
[error_message_prefix] =>
[mode] => 1
[level] => 1024
[code] => 10002
[message] => PLAIN authentication failure [SMTP: Invalid response code received from server (code: 535, response: Incorrect authentication data)]
[userinfo] =>
[backtrace] => Array
(
[0] => Array
(
[file] => /usr/share/pear/PEAR.php
[line] => 566
[function] => pear_error
[class] => pear_error
[type] => ->
[args] => Array
(
[0] => PLAIN authentication failure [SMTP: Invalid response code received from server (code: 535, response: Incorrect authentication data)]
[1] => 10002
[2] => 1
[3] => 1024
[4] =>
)

)

[1] => Array
(
[file] => /usr/share/pear/Mail/smtp.php
[line] => 242
[function] => raiseerror
[class] => pear
[type] => ::
[args] => Array
(
[0] => PLAIN authentication failure [SMTP: Invalid response code received from server (code: 535, response: Incorrect authentication data)]
[1] => 10002
)

)

[2] => Array
(
[file] => /home/www/wmail/html/test.php
[line] => 22
[function] => send
[class] => mail_smtp
[type] => ->
[args] => Array
(
[0] => test@server.de
[1] => Array
(
[MIME-Version] => 1.0
[From] => Tester
[To] => test@server.de
[Subject] => Ein kleines Test
[Message-Id] => <20060806093915.22441@ns.server.de>
[Content-Type] => text/plain; charset="ISO-8859-1"
[Content-Transfer-Encoding] => 7bit
)

[2] => Mal sehen was es passiert...
Ist nur wegen der Autentifizierung...

)

)

)

[callback] =>
)
]

Ngrep of the SMTP session:

#######
T XX.XX.XX.XX:25 -> XX.XX.XX.XX:58435 [AP]
220 mail.server.de ESMTP Exim 4.60 Sun, 06 Aug 2006 09:39:15 +0200..
##
T XX.XX.XX.XX:58435 -> XX.XX.XX.XX:25 [AP]
EHLO ns.server.de..
##
T XX.XX.XX.XX:25 -> XX.XX.XX.XX:58435 [AP]
250-mail.server.de Hello ns.server.de [XX.XX.XX.XX]..250-SIZE 1048576000..250-8BITMIME..250-PIPELINING..250-AUTH PLAIN LOGIN CRAM-MD5 NTLM..250-S
TARTTLS..250 HELP..
#
T XX.XX.XX.XX:58435 -> XX.XX.XX.XX:25 [AP]
AUTH PLAIN..
#
T XX.XX.XX.XX:25 -> XX.XX.XX.XX:58435 [AP]
535 Incorrect authentication data..
#
T XX.XX.XX.XX:58435 -> XX.XX.XX.XX:25 [AP]
RSET..
#
T XX.XX.XX.XX:25 -> XX.XX.XX.XX:58435 [AP]
250 Reset OK..
##
T XX.XX.XX.XX:25 -> XX.XX.XX.XX:58435 [AP]
421 mail.server.de lost input connection..
#

[2006-09-11 06:24 UTC] lucabert at lucabert dot de

I can't believe that Exim does NOT implement a RFC valid SMTP-Auth...

See here: http://www.exim.org/exim-html-4.62/doc/html/spec_html/ch34.html