112111 - Mail&News automatically pops up dialog for saving malicious attachment

Status: VERIFIED DUPLICATE of bug 109249

(MailNews Core :: MIME, defect)

Description

[Dimitrios]

Just received a message containing virus (or worm, I am not sure since I didn't
try to run the .exe file). This message, *when previewed*, always makes Mozilla
to show a save as dialog. I never saw this behaviour in the past. Attachments
were always shown in attachment pane and there was always a need for user
interaction in order to save or open them. I don't consider it top security
issue since (thankfully) the attachment isn't executed automatically, but it
might fool average users (anything saved automatically might be considered as
"trusted").

Message body is in html format while mime info is:
Content-Type: audio/x-wav;
name="sample.exe"
Content-Transfer-Encoding: base64

Attaching the malicious message (only the first two lines of the attached .exe,
if you want the whole message please tell me) and a screenshot of the dialog
popping up when previewing the message.

Comment 1

[Dimitrios]

Attachment: message source

Comment 2

[Dimitrios]

Attachment: screenshot

Comment 3

[Dimitrios]

Additional note: There is no attachment pane for this message, thus making it
even more dangerous.

Comment 4

[Jean-Francois Ducarroz]

does not seem good!

Comment 5

[Boris Zbarsky [:bzbarsky]]

*** Bug 112054 has been marked as a duplicate of this bug. ***

Comment 6

[Boris Zbarsky [:bzbarsky]]

we also seem to be automatically running helper apps on attachments

Comment 7

[Boris Zbarsky [:bzbarsky]]

Duplicate of "Security impact by mozilla automatically attempting to download
mail parts"

*** This bug has been marked as a duplicate of 109249 ***

Comment 8

[[e-mail] (gone - use [e-mail] instead)]

verified dup.