Vulnerability Development mailing list archives

Eudora incoming email affects behavior


From: kluegel () LANL GOV (Thomas Kluegel)
Date: Fri, 18 Feb 2000 02:34:32 -0000


When a person downloads and uses the newly released adware
Eudora 4.3, Qualcomm eventually sends out an email entitled:

"Eudora Profile Information for youraddress () domain com".

When Eudora receives this email it recognizes it as special
and loads personal profile information.  This seems very
questionable, to distribute a client that can respond to
special message emails sent to it.  One wonders, what else
can it do?  Whatever Qualcomm can make it do via email,
surely a forged email sent by anybody could do the same.
Also, we have to take their word that arbitrary code
execution isn't a part of the new Eudora's design.

Am I off in the weeds with my concern on this?

-- Tom Kluegel


Current thread: