Recent addtions include:
Long subject attachment checking bypass test [for Outlook Express 6 and Outlook 2000] - This test checks whether an email system accepts emails with long subjects; in some versions of Outlook and Outlook Express, long subjects can be used to bypass attachment checking.
Attachment with no filename vulnerability test - This test examines whether an email system accepts executable code that can bypass content checking security solutions. Because this attachment has no filename, the executable code it contains will not be detected by most content checking software, and the code can be executed using Outlook.
Long filename vulnerability test - Attachments with long filenames can be used to trick a user into double-clicking an attachment, thereby executing the malicious code it contains on the system: as the long filename is truncated by the email client, the attachment can be made to look like an innocent file (for example, a JPG image file). This test indicates whether a system can block emails that use this exploit.
Popup Object Exploit vulnerability test - The Popup Object Exploit automatically launches files on the vulnerable system, so a secure email system should not accept emails that contain this exploit.
Double file extension vulnerability test - This test checks whether your email system accepts emails which contain attachments with double file extensions, for example mypicture.jpg.hta. The actual file extension for this attachment would be HTA (HTML application), which is executable code. However, this exploit may trick users into thinking that this is a harmless JPG image file.
You can test your e-mail system security by visiting GFI's Email Security Testing Zone at: http://www.gfi.com/emailsecuritytest
Image 1.1: Example of a successful Email Security Testing Zone exploit
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.