[Full-Disclosure] Re: Eudora 5.2.1 attachment spoof

From: Paul Szabo (pszat_private)
Date: Mon May 26 2003 - 19:27:22 PDT

Next message: bugzillaat_private: "[Full-Disclosure] [RHSA-2003:171-01] Updated CUPS packages fix denial of service attack"

Previous message: K. K. Mookhey: "[VulnWatch] NII Advisory - Buffer Overflow in Analogx Proxy"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Building on my Eudora attachment spoof

  http://www.securityfocus.com/archive/1/322286

I have now found better games to play:

  From: me
  To: you

  Ensure victim has both attachments 'calc' and 'calc.exe' (sent in
  this, or previous, email). Then the following shows 'windows' icon
  and runs calc.exe without warning when clicked:
  Attachment Converted<CR>: attach\calc

Other mis-features I found (but I do not see how to make them into a
credible exploit):

  If we can guess the full path to the attach directory then can
  change the name shown to anything we like, but get broken icon:
  Attachment Converted<CR>: <A href=H:/windows/.eudora/attach/calc>file.txt</a>

  Javascript done with InternetExplorer even if we set own viewer:
  Attachment Converted<CR>: <A href=javascript:alert('hello')>hello.txt</a>

Replace the four-character <CR> marker with the single byte CR=0x0d in all
of above. Tested with Eudora 5.2.1 on Windows 2000.

Cheers,

Paul Szabo - pszat_private  http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics  University of Sydney   2006  Australia
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Next message: bugzillaat_private: "[Full-Disclosure] [RHSA-2003:171-01] Updated CUPS packages fix denial of service attack"
Previous message: K. K. Mookhey: "[VulnWatch] NII Advisory - Buffer Overflow in Analogx Proxy"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon May 26 2003 - 19:53:54 PDT