full-disclosure - Microsoft Outlook Vulnerability: S/MIME Loss of Integrity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAL3K1gbRz2K0XqEswpc5znc+kB1SNsMPUShax=G6DREYxMWyig@mail.gmail.com>
Date: Sun, 16 Jun 2013 00:51:10 +0930
From: Defence in Depth <defenceindepth@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Microsoft Outlook Vulnerability: S/MIME Loss of
	Integrity

** Attention script bunnies: This is not an RCE, XSS, etc. Please move
along :) **

Microsoft Outlook (all versions) suffers from an S/MIME loss of integrity
issue.
Outlook does not warn against a digitally signed MIME message whose X509
EmailAddress attribute does not match the mail's "From" address.

Full details:
http://www.defenceindepth.net/2013/06/smime-bucking-phishing-trend.html

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/