Vulnerability Development mailing list archives

netscape 4.61 recognizes file.changed-doc/xls


From: chadth () OBFUSTECH COM (Chad Thunberg)
Date: Tue, 23 May 2000 11:54:33 -0700


Do to the increasing threat of viruses, I have added procmail filters to
mangle the .ext of attachments so users would have to rename the file after
saving the file to disk.  This gives our antivirus a chance to scan the file
and allows users 30secs to think about what they are doing.  What I have
noticed is, netscape mail (ver 4.61) recognizes attachments that have been
renamed.  We sent two seperate emails with attachments, one with test.doc
and one with test.xls.  Upon receiving the email, the attachment's name was
changed to test.1234DEFACED-DOC and test.1234DEFACED-XLS.  After double
clicking the attachments, netscape mail gives the user the option of opening
the file with winword.exe and excel.exe.  We also tested with .bat and
various other .ext but only winword and excel associated files were
recognized.  Can anyone else confirm or deny this?

Thanks,
Chad Thunberg


Current thread: