vulnwire
7.5high

CVE-2000-03424 exploits

Eudora 4.x allows remote attackers to bypass the user warning for executable attachments such as .exe, .com, and .bat by using a .lnk file…

Published 26 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
3.5%
percentile 89%
Public exploits
4
Exploit-DB

Eudora 4.x allows remote attackers to bypass the user warning for executable attachments such as .exe, .com, and .bat by using a .lnk file that refers to the attachment, aka "Stealth Attachment."

Exploit prediction (EPSS)

3.45% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.

Exploits and detections

  • EDB-23399 Qualcomm Eudora 6.0.1/6.1.1 - Attachment LaunchProtect Warning Bypass (2) · remote · 2003-11-25
  • EDB-23398 Qualcomm Eudora 6.0.1/6.1.1 - Attachment LaunchProtect Warning Bypass (1) · remote · 2003-11-25
  • EDB-22627 Qualcomm Eudora 5.2.1/6.0 - File Attachment Spoofing Variant · remote · 2003-05-22
  • EDB-19885 Qualcomm Eudora 4.2/4.3 - Warning Message Circumvention · dos · 2000-04-28

CVSS scores

Assigned byVersionScoreVector
NVD3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

  • peacefire.org /security/stealthattach/explanation.html · x_refsource_MISC, x_transferred
  • news.cnet.com /news/0-1005-200-1773077.html?tag=st.ne.fd.lthd.1005-200-1773077 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/1157 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.