While developing one of our advanced security training movies, we identified an exploitable vulnerability in the latest release of InterVetions' MailCopa. Successful exploitation of this vulnerability allows an attacker to execute arbitrary code in the context of the user executing MailCopa. In a web-based attack scenario, an attacker can insert a link in the following way: <a href="mailto:test@xxxxxxxxxxx?subject=aaaaaaaaaaaa ... aaaaaaaaaaaaa"> If the user can be tricked into clicking on such a malicious link, an overflow occurs, leading to code execution on the victim's system. Countermeasures: The vendor was informed on April 30, 2007 and published a patched version just a few hours later. Amazing response time! Credits: skilltube.com If you are interested in learning more about vulnerability research and exploitation techniques, check out our advanced security training movies on www.skillTube.com.
