[virusinfo] Critical vulnerability in Eudora - 05/11/04
- From: "Mike" <mikebike@xxxxxxxxx>
- To: virusinfo@xxxxxxxxxxxxx
- Date: Wed, 12 May 2004 11:22:15 -0700
From; Panda Oxygen3 24h-365d:
"Wisdom begins in wonder."
Socrates (470 - 399 BC); Greek philosopher.
- Critical vulnerability in Eudora -
Oxygen3 24h-365d, by Panda Software (http://www.pandasoftware.com)
Madrid, May 11, 2004 - SecurityTracker has reported -at
http://www.securitytracker.com/alerts/2004/May/1010088.html -, a buffer
overflow vulnerability in the mail client Eudora, which could allow an
attacker to run arbitrary code and compromise affected systems.
This vulnerability has been detected in versions 6.1, 6.0.3 and 5.2.1 of
Eudora for Windows, and lies in the processing of URLs that start with
'file://'. The buffer overflow is triggered when the URL is longer than
approximately 300 characters, and could crash the application or even allow
arbitrary code to be run on affected systems.
In order to exploit this vulnerability, an attacker could construct and send
an e-mail message containing a specially-crafted link. In order to trigger
the buffer overflow, the recipient of the e-mail must click on the
specially-crafted link.
In order to avoid falling victim to this vulnerability and other techniques
based on specially-crafted URLs, avoid clicking on links included in e-mail
messages, especially those from unreliable sources. If in doubt, it is
always advisable to enter the URL directly in the address bar in the
browser, instead of clicking on the link.
NOTE: The address above may not show up on your screen as a single line.
This would prevent you from using the link to access the web page. If this
happens, just use the 'cut' and 'paste' options to join the pieces of the
URL.
------------------------------------------------------------
The 5 viruses most frequently detected by Panda ActiveScan,
Panda Software's free online scanner: 1) Netsky.P; 2) Netsky.D;
3) Briss.A; 4) Netsky.Z; 5) Netsky.B.
*********** MIKE"S REPLY SEPARATOR ***********
Mike ~ It is a good day if I learned something new.
Editor MikesWhatsNews see a sample on my web page
http://www3.telus.net/mikebike
<mikeswhatsnews-request@xxxxxxxxxxxxx?Subject=subscribe>
http://www3.telus.net/mikebike/worm_removal.htm
See my Anti-Virus pages http://virusinfo.hackfix.org/index
<virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe>
A Technical Support Alliance and OWTA Charter Member
Other related posts:
- » [virusinfo] Critical vulnerability in Eudora - 05/11/04
