Gadu-Gadu File Download Filename Obfuscation Weakness

Bugtraq ID:	11017
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 23 2004 12:00AM
Updated:	Aug 23 2004 12:00AM
Credit:	Bartosz Kwitkowski <[email protected]> disclosed this weakness.
Vulnerable:	Gadu-Gadu Instant Messenger 6.0
Not Vulnerable:

Gadu-Gadu File Download Filename Obfuscation Weakness

Gadu-Gadu is a Polish instant messaging application for Microsoft Windows operating systems.

It is reported that the Gadu-Gadu instant messenger application contains a weakness allowing attackers to obfuscate file extensions.

This may allow an attacker to send potentially malicious executable files to users who think that they are downloading files that are believed to be harmless.

Gadu-Gadu File Download Filename Obfuscation Weakness

An exploit is not required.

An example filename might be (spaces encoded as %20 for clarity):

file.ext%20(220%20kB)%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20.exe

Gadu-Gadu File Download Filename Obfuscation Weakness

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Gadu-Gadu File Download Filename Obfuscation Weakness

References:

• GADU-GADU - long file name... part 2 (Bartosz Kwitkowski )
  
• Vendor Homepage (Gadu-Gadu)