Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Instant Messaging/IRC/Chat)  >   Gadu-Gadu Vendors:
Gadu-Gadu File Downloading Dialog Lets Remote Authenticated Users Spoof the File Extension
SecurityTracker Alert ID:  1011037
SecurityTracker URL:
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Aug 24 2004
Impact:   Modification of system information
Exploit Included:  Yes  
Version(s): 6.0
Description:   A vulnerability was reported in the Gadu-Gadu chat client. A remote authenticated user can send a file with a spoofed file extension.

Bartosz Kwitkowski reported that a remote authenticated user can create a link with a specially crafted filename so that the recipient's Gadu-Gadu client displays a filename with a spoofed file extension when the recipient attempts to download the file. This can be achieved by appending a large number of space characters followed by the actual file extension to the spoofed filename.

A demonstration exploit filename is provided:

A demonstration exploit screen shot is available at:

It is reported that when the target user attempts to save the file, the actual extension can be seen.

Impact:   A remote authenticated user can spoof a filename extension.
Solution:   No solution was available at the time of this entry.
Vendor URL: (Links to External Site)
Cause:   State error
Underlying OS:  Windows (Any)

Message History:   None.

 Source Message Contents

Subject:  GADU-GADU Instant messanger - long file name

Well, this thing is similar to vuln in IE.
We can create file with long name and remote user can notice only safe extension.

Example file name:

But this is more complicated than we can thought.
I've tested this. I can only say, when file is downloading extension spoofing works correctly. When user is going to save file he
 can notice dangerous extension.

We can add to file name after .jpg (228 kB).
File size should be the same as written.


{other stuff-crap-to make bigger file size}


sorry, i don't have screenshot with view from remote comp.

I've tested this on 5 random selected people. 4 - opened file. :-).

Best regards,
Bartosz Kwitkowski


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC