[Full-Disclosure] Re: REFRESH: EUDORA MAIL 5.1.1

From: Doug Monroe (monwelat_private)
Date: Thu Jul 25 2002 - 06:59:59 PDT

  • Next message: Tim Brown: "Medium security hole affecting W3Mail"

    "http-equivat_private" wrote:
    > 
    > Tuesday, July 23, 2002
    > Trivial silent delivery and installation of an executable on a target
    > computer. This  can be accomplished with the default installation of
    > the mail client Eudora  5.1.1:
    > 'allow executables in HTML content' DISABLED
    > 'use Microsoft viewer' ENABLED
    [snip]
    > Working Example:
    [snip]
    > http://www.malware.com/boodora.txt
    > 
    > Notes: disable 'use Microsoft viewer'
    
    A Eudora expert I am not, but I suppose one could also change
      HKCU/software/qualcomm/eudora/launchmanager/path#2  
    from 
    "c:\windows\application data\qualcomm\eudora\embedded" 
     or
    "c:\program files\qualcomm\eudora pro\embedded" 
    to some other, non-default folder name. 
    New folder must exist before running eudora again.
    
    And... add mhtml to "WarnExtentions#X" key values?
    _______________________________________________
    Full-Disclosure - We believe in it.
    Full-Disclosureat_private
    http://lists.netsys.com/mailman/listinfo/full-disclosure
    



    This archive was generated by hypermail 2b30 : Thu Jul 25 2002 - 07:56:18 PDT