Qualcomm Eudora File Attachment Spoofing Vulnerability
BID:5432
Info
Qualcomm Eudora File Attachment Spoofing Vulnerability
| Bugtraq ID: | 5432 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 08 2002 12:00AM |
| Updated: | Aug 08 2002 12:00AM |
| Credit: | Discovery of this issue is credited to Paul Szabo <[email protected]>. |
| Vulnerable: |
Qualcomm Eudora 6.1.1 Qualcomm Eudora 6.0.1 Qualcomm Eudora 6.0 Qualcomm Eudora 5.2.1 Qualcomm Eudora 5.2 Qualcomm Eudora 5.1 |
| Not Vulnerable: | |
Discussion
Qualcomm Eudora File Attachment Spoofing Vulnerability
Eudora is reported to be prone to an issue which may allow attackers to spoof the file extension in an attachment. This may aid an attacker in enticing a user of the e-mail client into executing malicious content, and in avoiding generating warning messages.
It is possible to refer to other files or attachments in a message through specially formatted inline text. It has been demonstrated possible to misrepresent some aspects of files referenced in this manner. This may cause end users to make erroneous judgements about the nature of file attachments, and allow malicious attachments to bypass normal warning dialogs displayed when executable content is launched.
If an attachment path to an executable file has a single '.' character appended, warning messages will not be displayed. Attachments such as 'calc.exe.' may execute when launched without the requirement for further interaction. Additionally, an arbitrary file name may be specified by the attacker which will be displayed to the end user. If a filename such as 'readme.txt' is associated with a malicious, executable attachment, the user may make innacurate decisions about the risk associated with opening the attachment. If the specified file does not exist on the local system, the full path provided will be used to locate and launch a file, with no further warnings given.
Successful exploitation may require the attacker to know the full path to the attachment directory.
** A new version of Eudora is available however, reports suggest that the new version may still be affected.
** May 21, 2004 - Eudora version 6.1.1 has been released, however, it is reported that the new versions is vulnerable to this issue as well.
Eudora is reported to be prone to an issue which may allow attackers to spoof the file extension in an attachment. This may aid an attacker in enticing a user of the e-mail client into executing malicious content, and in avoiding generating warning messages.
It is possible to refer to other files or attachments in a message through specially formatted inline text. It has been demonstrated possible to misrepresent some aspects of files referenced in this manner. This may cause end users to make erroneous judgements about the nature of file attachments, and allow malicious attachments to bypass normal warning dialogs displayed when executable content is launched.
If an attachment path to an executable file has a single '.' character appended, warning messages will not be displayed. Attachments such as 'calc.exe.' may execute when launched without the requirement for further interaction. Additionally, an arbitrary file name may be specified by the attacker which will be displayed to the end user. If a filename such as 'readme.txt' is associated with a malicious, executable attachment, the user may make innacurate decisions about the risk associated with opening the attachment. If the specified file does not exist on the local system, the full path provided will be used to locate and launch a file, with no further warnings given.
Successful exploitation may require the attacker to know the full path to the attachment directory.
** A new version of Eudora is available however, reports suggest that the new version may still be affected.
** May 21, 2004 - Eudora version 6.1.1 has been released, however, it is reported that the new versions is vulnerable to this issue as well.
Exploit / POC
Qualcomm Eudora File Attachment Spoofing Vulnerability
The following example of an attachment reference has been provided:
Attachment Converted: "c:\winnt\system32\calc.exe." "\README.txt"
Paul Szabo has provided proof of concept code.
The following example of an attachment reference has been provided:
Attachment Converted: "c:\winnt\system32\calc.exe." "\README.txt"
Paul Szabo has provided proof of concept code.
Solution / Fix
Qualcomm Eudora File Attachment Spoofing Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.