POP3: .MSC

This signature detects e-mail attachments that have the extension .msc and were received through POP3. Because .MSCs ( Microsoft Common Console Document) files can contain configuration information, this can indicate an incoming e-mail virus. Attackers can change the configuration to point to a dangerous command, tricking users into executing the files and infecting the system.

Extended Description

Malware writers can exploit this vulnerability by inserting malicious configuration settings in the .msc file. A target system is compromised if an unsuspecting user opens a .msc file, which is usually received by e-mail. The impact on the target system is dependent on the instructions contained in the malicious .msc file.

References

URL: http://www.cknow.com/vtutor/FileExtensions.html http://www.novatone.net/mag/mailsec.htm http://support.microsoft.com/?kbid=235309

Short Name

POP3:EXT:DOT-MSC

Severity

Major

Recommended

False

Recommended Action

Drop

POP3: .MSC

Extended Description

References

Found a potential security threat?