-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 While I'm unaware of any current virus that exhibits this behavior there is a reasonable possibility to create one. This possibility relies upon 1 of 2 conditions existing on the mail server:
1) A message parsing vulnerability such as the recent sendmail vulnerability see http://www.securityfocus.com/bid/6991/discussion/ 2) The server performs some message processing such as virus scanning or spam checking. This could exploit an application used in the processing such as unzip, see http://www.securityfocus.com/bid/7550/discussion/ Since in both exploits the server is infected while processing part of the message it may be possible for the message to still reach a recipient and contain a 2nd virus payload. Of course exploiting #1 and #2 requires targeting a specific email server or package on a specific platform. It would seem that this attack vector leads to the possibility of remotely exploiting virus scanning engines and other tools that are used on mail servers. mrichard >Is anyone aware of a virus, transmitted via email, that is able to >exploit the email server it resides on? > >Eg: > >User A is infected by virus >User A sends email to friend >Virus follows email and is stored on Email Server A >Virus exploits Email Server A, infects other emails, causes world >domination, etc. > >As far as I know this is not possible because the MTA should treat >the virus as data, not code. Have there been any known cases of the >above? I have done some research on Symantec's virii database, asked >around, etc. and haven't heard of anything. > >Thanks, > >Joshua Thomas >Network Operations Engineer >PowerOne Media, Inc. -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.3 wkYEARECAAYFAj8enrsACgkQr4Naal5vyKezcACfb8O0F14frcb/2/z74/YPbTdWP40A oIqpNNwDhaCSjREWGrQ6FllilIuN =K6cw -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
