Secunia

Paul Szabo has reported multiple vulnerabilities in Eudora 6, allowing malicious people to spoof attachments or compromise a user's system.

1) A boundary error within the handling of filenames can be exploited to cause a buffer overflow by passing an overly long filenames (250 bytes). Successful exploitation may potentially allow execution of arbitrary code.

This vulnerability reportedly affects versions 6.0 and prior and has been re-introduced in version 6.1.

2) It is possible to cause Eudora to show a different name than the actual attachment name. This may be exploited to trick users into opening malicious files.

This vulnerability reportedly affects versions 6.2 and prior.

Note: According to the vendor this vulnerability has been fixed. However, Paul Szabo has identified variants of the issue.

Other security issues have also been identified. However, they trigger a warning dialog.

These issues have previously been reported for Eudora 5.

Solution
The vendor has reportedly fixed the vulnerabilities in version 6.2.1.
Further details available in Customer Area

Provided and/or discovered by
Paul Szabo

Changelog
Further details available in Customer Area

Original Advisory
http://www.eudora.com/security.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area