Hastymail HTML Attachment Script Execution Vulnerability

Bugtraq ID:	11022
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 24 2004 12:00AM
Updated:	Aug 24 2004 12:00AM
Credit:	Discovery is credited to Manish Raje.
Vulnerable:	Hastymail Hastymail 1.1 Hastymail Hastymail 1.0.1
Not Vulnerable:	Hastymail Hastymail 1.2 Hastymail Hastymail 1.0.2

Hastymail HTML Attachment Script Execution Vulnerability

Hastymail is reported prone to a script execution vulnerability that could allow a remote attacker to execute arbitrary HTML or script code in the browser of a vulnerable user.

It is reported that if a user attempts to download an HTML attachment through the application's interface, the browser may examine the file extension and open the file inline.

A remote attacker can create a malicious HTML attachment and send it to a user. If the user attempts to download the attachment, the user's browser will open the unfiltered attachment. This can allow for JavaScript or HTML code to execute in the browser leading to cookie-based credential theft or other attacks.

Hastymail Stable version 1.0.1 and Development version 1.1 are affected by this issue. It is likely that prior versions are affected as well.

Hastymail HTML Attachment Script Execution Vulnerability

No exploit is required.

Hastymail HTML Attachment Script Execution Vulnerability

Solution:
The vendor has released updates to address this issue.


Hastymail Hastymail 1.0.1

• Hastymail Stable 1.0.2
  http://sourceforge.net/project/showfiles.php?group_id=66202&package_id =127017&release_id=262778

Hastymail Hastymail 1.1

• Hastymail Development 1.2
  http://sourceforge.net/project/showfiles.php?group_id=66202&package_id =127016&release_id=262787

Hastymail HTML Attachment Script Execution Vulnerability

References:

• Homepage (Hastymail)
  
• Security UPDATE 8-24-2004 (Hastymail)
  
• Hastymail security update ("Jason Munro" )