133151 - Message causes virus to be written to disk

Status: RESOLVED DUPLICATE of bug 109249

(MailNews Core :: MIME, defect)

Description

[Alec Flett]

I just got this message in my inbox, and as soon as I went to view it, somehow
it tried to write an executable to disk..strangely, at the same time it popped
up a "save-as" dialog at the same time. My guess is that it was streaming to
disk in order to save it, and thats when it got written.

I'm attaching the .eml file so someone can try it. There is no way we should be
writing out decoded files to disk without the user's permission!

Comment 1

[Alec Flett]

Attachment: The file that triggered the virus - careful - has a virus in it!

Be careful with this file - there is a virus encoded as an attachment here.

Comment 2

[timeless]

*** This bug has been marked as a duplicate of 109249 ***

Comment 3

[Ben Bucksch (:BenB)]

Comment on attachment 75862 [details]
The file that triggered the virus - careful - has a virus in it!

Changing mimetmype to rfc822, so we can test right in the browser.

Comment 4

[Ben Bucksch (:BenB)]

Attachment: Same message, opening directly in the browser

Comment 5

[Ben Bucksch (:BenB)]

Comment on attachment 75862 [details]
The file that triggered the virus - careful - has a virus in it!

Changing back to plaintext, so you can view the source in the browser (a bug in
Mozilla's View Source prevents this otherwise). I Created a new attachment with
rfc822 mimetype.