112054 - Automatic executiong of attachments

Status: VERIFIED DUPLICATE of bug 109249

(SeaMonkey :: MailNews: Message Display, defect)

Description

[Benjamin Robson]

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:0.9.6) Gecko/20011120
BuildID:    2001112012

Upon receipt of a mail attachment Mozilla attempts to execute the attachment. 
i.e. Upon receiving a worm blah.mp3.pif Mozilla requests execution of the "mp3"
using RealPlay (if helper-app installed).
If a vulnerability were to exist in the RealPlay client (or any other
application that is set up as a helper-app) then the mail client would allow a
security threat to the Linux operating system.

Reproducible: Always
Steps to Reproduce:
1.Receive Email containing worm
2.Select Email (as to read it)
3.

Actual Results:  A dialog box was shown requesting approval to execute using
Realplay, or if I wished to save the file.

Expected Results:  It should have shown an attachment, but not attempted to do
anything with it.  This would allow the user to then see the file attchement,
including its file name, and decide to execute or delete.

Comment 1

[Arthur]

Confirming on Linux. I don't think it's really a security threat as mozilla
doesn't automatically execute any program (it's up to the user to decide whether
to click ok or not and the worms are mostly win-worms), but it's annoying if you
get lots of virus mails. You have to cancel all the dialogs. This happens to me
quite often at the moment because some of these worms resend themself multiple
times.

Comment 2

[Ivan Tarapcik]

This IS a security threat. I'm adding attachment with email message, that 
caused execution of IE (helper application for audio/x-wav or .pif extension - 
does not matter here) immediately after message was displayed in preview.

The message contains an <IFRAME> with src= part with mime-type=audio/x-wav and 
filename=xyz.mp3.pif

Comment 3

[Ivan Tarapcik]

Attachment: Example of auto executing email worm

attachment in this messages executes when message is displayed. 
NOTE: the virus is NOT removed from the messages!!!
Version: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:0.9.6+) Gecko/20011126

Comment 4

[Boris Zbarsky [:bzbarsky]]

*** This bug has been marked as a duplicate of 112111 ***

Comment 5

[[e-mail] (gone - use [e-mail] instead)]

dup of http://bugzilla.mozilla.org/show_bug.cgi?id=109249

Comment 6

[[e-mail] (gone - use [e-mail] instead)]

*** This bug has been marked as a duplicate of 109249 ***

Comment 7

[[e-mail] (gone - use [e-mail] instead)]

verified.