Full Disclosure mailing list archives

Microsoft Outlook Vulnerability: S/MIME Loss of Integrity

From: Defence in Depth <defenceindepth () gmail com>
Date: Sun, 16 Jun 2013 00:51:10 +0930

** Attention script bunnies: This is not an RCE, XSS, etc. Please move
along :) **

Microsoft Outlook (all versions) suffers from an S/MIME loss of integrity
issue.
Outlook does not warn against a digitally signed MIME message whose X509
EmailAddress attribute does not match the mail's "From" address.

Full details:
http://www.defenceindepth.net/2013/06/smime-bucking-phishing-trend.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Current thread:

Microsoft Outlook Vulnerability: S/MIME Loss of Integrity Defence in Depth (Jun 15)
- Re: Microsoft Outlook Vulnerability: S/MIME Loss of Integrity Valdis . Kletnieks (Jun 17)
  - Re: Microsoft Outlook Vulnerability: S/MIME Lossof Integrity ACROS Security Lists (Jun 17)
    - Re: Microsoft Outlook Vulnerability: S/MIME Lossof Integrity Valdis . Kletnieks (Jun 17)
    - Re: Microsoft Outlook Vulnerability: S/MIMELossof Integrity ACROS Security Lists (Jun 17)
    - Re: Microsoft Outlook Vulnerability: S/MIMELossof Integrity Jeffrey Walton (Jun 17)
    - Re: Microsoft Outlook Vulnerability: S/MIMELossof Integrity Daniël W . Crompton (Jun 17)
    - Re: Microsoft Outlook Vulnerability: S/MIMELossof Integrity Jeffrey Walton (Jun 17)
  - Re: Microsoft Outlook Vulnerability: S/MIME Loss of Integrity Patrick Dunstan (Jun 17)
    - Re: Microsoft Outlook Vulnerability: S/MIME Loss of Integrity Jeffrey Walton (Jun 17)
    - Re: Microsoft Outlook Vulnerability: S/MIME Loss of Integrity Darius Jahandarie (Jun 18)

(Thread continues...)