Qualcomm Eudora Embedded Hyperlink URI Obfuscation Weakness
BID:10305
Info
Qualcomm Eudora Embedded Hyperlink URI Obfuscation Weakness
| Bugtraq ID: | 10305 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 08 2004 12:00AM |
| Updated: | May 08 2004 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Brett Glass <[email protected]>. |
| Vulnerable: |
Qualcomm Eudora 6.1 Qualcomm Eudora 6.0.3 Qualcomm Eudora 6.0.1 Qualcomm Eudora 6.0 .22 Qualcomm Eudora 6.0 Microsoft Outlook Express 6.0 |
| Not Vulnerable: | |
Discussion
Qualcomm Eudora Embedded Hyperlink URI Obfuscation Weakness
It has been reported that the Qualcomm Eudora MTA is prone to a URI obfuscation weakness that may hide the true contents of a link. The problem occurs when a user@location URI is formatted in such a way that a "^A" control character is located after the user value. The user value may then be appended with space characters to obfuscate status bar and mouseover details. It is said that, when doing a mouseover of such a URI, it will cause the status bar to only display the contents of the user value, not the entire link.
It has been reported that the Qualcomm Eudora MTA is prone to a URI obfuscation weakness that may hide the true contents of a link. The problem occurs when a user@location URI is formatted in such a way that a "^A" control character is located after the user value. The user value may then be appended with space characters to obfuscate status bar and mouseover details. It is said that, when doing a mouseover of such a URI, it will cause the status bar to only display the contents of the user value, not the entire link.
Exploit / POC
Qualcomm Eudora Embedded Hyperlink URI Obfuscation Weakness
It is reported that this issue is being actively exploited in the wild by an e-mail that is being spammed to end-users; the link that is contained in the spammed e-mail is as follows:
<a href="http://www.e-gold.com^A
          
          
          
          
          
          
          
          
          
          
          
          
          
          
          
          
@example.com/"><span lang=EN-US
style='mso-ansi-language:EN-US'>http://www.e-gold.com/alert</span></a><br>
Where example.com, reads egegold.com.
It is reported that this issue is being actively exploited in the wild by an e-mail that is being spammed to end-users; the link that is contained in the spammed e-mail is as follows:
<a href="http://www.e-gold.com^A
          
          
          
          
          
          
          
          
          
          
          
          
          
          
          
          
@example.com/"><span lang=EN-US
style='mso-ansi-language:EN-US'>http://www.e-gold.com/alert</span></a><br>
Where example.com, reads egegold.com.
Solution / Fix
Qualcomm Eudora Embedded Hyperlink URI Obfuscation Weakness
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Qualcomm Eudora Embedded Hyperlink URI Obfuscation Weakness
References:
References:
- Eudora Product Homepage (Qualcomm)
- Status bar exploit hides spoofed URLs Eudora, possibly other e-mail clients (Brett Glass