C
Curious Guy
Has Microsoft acknowledged the following vulnerability in
Outlook 2003?
Description:
http-equiv has reported a vulnerability in Microsoft
Outlook 2003, allowing malicious people to perform illegal
actions through emails.
Microsoft Outlook 2003 is supposed to protect the user by
opening mails in the restricted security zone, thereby
preventing the use of active scripting, download of files
and more.
However, it is possible to bypass the security settings by
embedding an OLE Object with reference to a Windows media
file in a Rich Text Format (RTF) message. This can be
exploited to start a download sequence of arbitrary files,
which in turn causes Internet Explorer to prompt the user
whether to download the file. However, combined with
SA11572 "Predictable File Location Weakness", it is
reportedly possible to launch the file without any warning.
This has been reported to affect Microsoft Outlook 2003.
Other versions may also be affected, however, they do not
promise to protect the user in the same way.
Solution:
Filter HTML and RTF messages.
Source:
http://secunia.com/advisories/11629/
Outlook 2003?
Description:
http-equiv has reported a vulnerability in Microsoft
Outlook 2003, allowing malicious people to perform illegal
actions through emails.
Microsoft Outlook 2003 is supposed to protect the user by
opening mails in the restricted security zone, thereby
preventing the use of active scripting, download of files
and more.
However, it is possible to bypass the security settings by
embedding an OLE Object with reference to a Windows media
file in a Rich Text Format (RTF) message. This can be
exploited to start a download sequence of arbitrary files,
which in turn causes Internet Explorer to prompt the user
whether to download the file. However, combined with
SA11572 "Predictable File Location Weakness", it is
reportedly possible to launch the file without any warning.
This has been reported to affect Microsoft Outlook 2003.
Other versions may also be affected, however, they do not
promise to protect the user in the same way.
Solution:
Filter HTML and RTF messages.
Source:
http://secunia.com/advisories/11629/