TITLE:
Microsoft Office 2003 "mailto:" Automatic Attachment of Arbitrary
Files

SECUNIA ADVISORY ID:
SA19819

VERIFY ADVISORY:
http://secunia.com/advisories/19819/

CRITICAL:
Not critical

IMPACT:
Manipulation of data, Exposure of sensitive information

WHERE:
>From remote

SOFTWARE:
Microsoft Office 2003 Student and Teacher Edition
http://secunia.com/product/2278/
Microsoft Office 2003 Standard Edition
http://secunia.com/product/2275/
Microsoft Office 2003 Small Business Edition
http://secunia.com/product/2277/
Microsoft Office 2003 Professional Edition
http://secunia.com/product/2276/

DESCRIPTION:
Inge Henriksen has discovered a weakness in Microsoft Office 2003,
which can be exploited by malicious people to disclose sensitive
information.

The weakness is caused due to Microsoft Office Outlook registering an
unsafe "mailto" URI handler. This can be exploited to automatically
attach an arbitrary file to an e-mail by tricking a user into
following a specially crafted link with the "mailto:" URI handler
from a malicious web site.

Example:
mailto:[mail]""..\..\..\..\..\[file]

The weakness has been confirmed on a fully patched system with
Microsoft Office Outlook 2003 SP1/SP2 and Microsoft Office 2003
Professional Edition. Other versions may also be affected.

SOLUTION:
Validate attachments before sending e-mails after opening links with
the "mailto:" URI handler.

PROVIDED AND/OR DISCOVERED BY:
Inge Henriksen

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------