In my last column, "Writing a Secure POP3 Server," I talked about protecting your POP3 mail server from attacks, and I identified some of the potential threats that you need to guard against. As I explained, the two main areas of concern when handling user input to your POP3 server are improperly formed commands and handling general network errors.
Request for Comments (RFC) 1939, which you can view at Ohio State's CIS Web site, defines the POP3 standard. Users can give the POP server commands, such as USER, PASS, and LIST. According to RFC 1939, the commands
"…consist of a case-insensitive keyword, possibly followed by one or more arguments. All commands are terminated by a CRLF pair. Keywords and arguments consist of printable ASCII characters. Keywords and arguments are each separated by a single SPACE character. Keywords are three or four characters long. Each argument may be up to 40 characters long." . . .
