AOH :: HP Unsorted I :: TB10691.HTM

InterVations' MailCopa vuln



Vulnerability in InterVations' MailCopa
Vulnerability in InterVations' MailCopa



While developing one of our advanced security training movies, we
identified an exploitable vulnerability in the latest release of
InterVetions' MailCopa. Successful exploitation of this vulnerability
allows an attacker to execute arbitrary code in the context of the
user executing MailCopa. In a web-based attack scenario, an attacker
can insert a link in the following way:

href="mailto:test@example.com?subject=aaaaaaaaaaaa ... aaaaaaaaaaaaa"> 

If the user can be tricked into clicking on such a malicious link, an
overflow occurs, leading to code execution on the victim's system.


Countermeasures:
The vendor was informed on April 30, 2007 and published a patched
version just a few hours later. Amazing response time!


Credits:
skilltube.com

If you are interested in learning more about vulnerability research
and exploitation techniques, check out our advanced security training
movies on www.skillTube.com. 





The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.