Chad Perrin: SOB

14 January 2010

Email Composed in Notepad?

Filed under: Geek,inanity — apotheon @ 11:37

I got an email on the bugtraq list that has some weird formatting quirk infesting it. The bugtraq archive won’t show the problem for us, but I’ll copy and paste it directly from Mutt for you here:

Release Date:^M
2010-01-14^M
^M
Product: ^M
OpenOffice^M
^M
Tested Vulnerable Versions: ^M
3.1.1 and 3.1.0^M
^M
Vulnerability:^M
Null Pointer^M
^M
^M
Description:^M
Hellcode Research discovered a null pointer vulnerability in Openoffice for Windows.^M
^M
Opening a malformed ".csv" file with Openoffice, causes a crash on "soffice.bin"^M
^M
^M
PoC:^M
http://tcc.hellcode.net/sploitz/csv.rar^M
^M
^M
Credits:^M
Hellcode Research^M
The Computer Cheats (TCC)^M
Natal Networks^M
^M
^M
Urls:^M
tcc.hellcode.net^M
forum.hellcode.net^M
www.natalnetworks.com^M
^M

I wonder how things like this happen. It looks like someone might have composed an email in Notepad then used some Unix tool to send it to a mail user agent of some sort. This is something I have seen before, a couple of times. Is there some email client that does this crap?

If you have an explanation that escapes me at the moment, I’d love to hear it. If they’re composing emails for the bugtraq list in Notepad, though, I’m pretty sure I wouldn’t ever want to work for them.

All original content Copyright Chad Perrin: Distributed under the terms of the Open Works License