bugtraq - OUTLOOK 2003: OuchLook

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200405092329.i49NTAND004961@web123.megawebservers.com>
Date: Sun, 9 May 2004 23:29:10 -0000
From: "http-equiv@...ite.com" <1@...ware.com>
To: <bugtraq@...urityfocus.com>
Cc: <NTBugtraq@...tserv.ntbugtraq.com>
Subject: OUTLOOK 2003: OuchLook

Sunday, May 09, 2004

Outlook 2003 the premier mail client from the company 
called 'Microsoft' certainly appears to have a lot of security 
features built into it.  Curosry examination shows excellent 
thought into 'spam' containment, 'security' consideration and 
many other little 'things'.

However there is a fundamental flaw with this particular device. 
That is, it copies our arbitrary file with given name into a 
known and easily reachable location:

<img src="malware.htm" style="display:none">

when embedded into the body of a mail message and when the 
recipient replies, will copy itself into temp folder:

C:\Documents and Settings\<user name>\Local Settings\Temp.htm

This location can be quite easily reached without having to know 
the user name [courtesy of jelmer]:

<a href="shell:user profile\\local 
settings\\temp\\malware.htm">http://office.microsoft.com/</a>

The scenario is 'painstakingly' trivial. Send your co-hort at 
the office an email that requires a reply. Embed in it, an html 
file out of sight. Either send them a second message with any 
number of 'spoofed' url schemes pointing to the file in the 
temp, or, direct them to a web site which will reach in into the 
temp folder via the same url and install and run our malicious 
software.

Very Silly Design Error.

End Call

-- 
http://www.malware.com