List-Hosted-by: Duta Integrasi Pratama - Indonesia
A friend just forwarded me this message from Bugtraq, a
well-informed and well-read bug- and security announcement
list. Apparently, TB has been caught having a bug:
=== fwd ===
Date: Mon, 2 Apr 2001 12:20:26 -0700
From: "[EMAIL PROTECTED]" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: ~..~!guano
Wednesday, 28 March, 2001
The BAT! ~..~ is a feisty multi-tasking email client that is
rapidly gaining popularity and for good reason. Cursory
examination of it reveals solid effective security measures
on all fronts, including non-browser dependent html viewing
(with on/off switch), random named file cache, exceptional
warnings when clicking on just about any attachment be it
*.html, *.txt etc. Really very good. Good warning scheme
others can learn from.
One problem. ~..~ ~..~ ~..~
We are able to blind the The BAT! ~..~ with trivial file
extension modifications and carefully calculated file name
lengths:
Content-Type:image/gif;
Content-Transfer-Encoding: base64
Content-Disposition: inline;
filename=" what's this?
.gif.exe"
Will create an inline attachment, which, while not important
will not be indicted in the in-box. What is important is
that the attachment viewed once the mail message has been
opened will be with the icon of something else. On two win98
machines, we achieved the icon of a folder:
(screen shot: http://www.malware.com/guano.jpg 32KB)
and the icon of the local machine hard drive. BAT! worse,
when clicking the icon, the *.exe is executed without
warning. The comprehensive warning for *.exe attachments is
bypassed. As far as the client is concerned there is no
attachment and their is no file extension, other than what
we decide to give it.
Tested on win98 and The Bat! Version 1.51 (The BAT! settings
appear to have no relation to this),
Working example (includes harmless *.exe):
Save to disk
http://www.malware.com/guano.eml
Create a new mail message in The Bat! attach the *.eml and
click on it and then the attachment therein. Manufactured
attachment sent directly to the The Bat! inbox results in
the same.
Notes: Manufacturer http://www.ritlabs.com/ informs they
will repair this in the next Beta.
~..~
---
http://www.malware.com
=== end fwd ===
- K -
--
At last official count nearly 500 gay and lesbian couples
had been united in civil unions this summer in Vermont.
There were flowers, champagne, brides and brides, grooms and
grooms. The sky did not fall. The earth did not split in
two. Happy families and happy friends watched happy people
pledge their love.
- Columnist Anna Quindlen, Newsweek, Sept. 11 2000.
--
______________________________________________________
Archives : <http://tbudl.thebat.dutaint.com>
Moderators : <mailto:[EMAIL PROTECTED]>
TBTech List: <mailto:[EMAIL PROTECTED]>
Unsubscribe: <mailto:[EMAIL PROTECTED]>
You are subscribed as : [EMAIL PROTECTED]
