full-disclosure - OUTLOOK 2003: OuchLook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: spectral at myrealbox.com (spectral@...ealbox.com)
Subject: OUTLOOK 2003: OuchLook

Can anyone verify this, coz I have some installations with
Outlook 2003 and I dont seem to see any files
copied to the Local Settings\Temp when using the img tag.


On Sun, 9 May 2004, http-equiv@...ite.com wrote:

> Date: Sun, 9 May 2004 23:31:08 -0000
> From: "http-equiv@...ite.com" <1@...ware.com>
> To: full-disclosure@...ts.netsys.com
> Subject: [Full-Disclosure] OUTLOOK 2003: OuchLook
>
>
>
> Sunday, May 09, 2004
>
> Outlook 2003 the premier mail client from the company
> called 'Microsoft' certainly appears to have a lot of security
> features built into it.  Curosry examination shows excellent
> thought into 'spam' containment, 'security' consideration and
> many other little 'things'.
>
> However there is a fundamental flaw with this particular device.
> That is, it copies our arbitrary file with given name into a
> known and easily reachable location:
>
> <img src="malware.htm" style="display:none">
>
> when embedded into the body of a mail message and when the
> recipient replies, will copy itself into temp folder:
>
> C:\Documents and Settings\<user name>\Local
> Settings\Temp\malware.htm
>
> This location can be quite easily reached without having to know
> the user name [courtesy of jelmer]:
>
> <a href="shell:user profile\\local
> settings\\temp\\malware.htm">http://office.microsoft.com/</a>
>
> The scenario is 'painstakingly' trivial. Send your co-hort at
> the office an email that requires a reply. Embed in it, an html
> file out of sight. Either send them a second message with any
> number of 'spoofed' url schemes pointing to the file in the
> temp, or, direct them to a web site which will reach in into the
> temp folder via the same url and install and run our malicious
> software.
>
>
> Very Silly Design Error.
>
> End Call
>
> --
> http://www.malware.com
>
>
>
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>