Hi, My statement was unclear with respect to Windows XP. I included this information about WinXP just for the record, to show that there is yet another vulnerability that could affect people running unpatched installations of WinXP. I did not wanted to confuse people into thinking that up-to-date WinXP boxes have another hole.
So my statement about WinXP should read : - if you run Windows XP unpatched, "out of the box", it is vulnerable to this issue (and, obviously, many other ones) - if you did apply MS02-060 patch (also included in SP1 ?), which makes the Help Center behave very differently, you are _safe_. I believe this is true. However, I am not a WinXP user, and I tried that 3 months ago, so I may be wrong or unclear. If someone has more accurate information, please post it on the list. Also, a guy from Microsoft told me Windows 2000 does not have an Help Center, so obviously Win2000 should not be affected by this issue. Fozzy On Thu, 27 Feb 2003 08:55:23 -0800 "Quaker Oats" <[EMAIL PROTECTED]> wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > Fozzy, > > If you read MSFT's advisory, it seems as though they don't believe Windwos XP is > vulnerable at all. This runs counter to what you're saying. What's the deal? > > > - -----Original Message----- > From: Fozzy [Hackademy Audit] [mailto:[EMAIL PROTECTED] > Sent: Thursday, February 27, 2003 12:08 AM > To: [EMAIL PROTECTED] > Subject: [Full-Disclosure] MS-Windows ME IE/Outlook/HelpCenter critical > vulnerability > > > /BEGIN CLIP > > > - --[ Affected Systems ]-- > > - - Windows ME (any version) > - - Windows XP without SP1 > > Not vulnerable : > - - Windows XP with SP1 > > Status of Windows 2000 was not tested but is believed to be the same as > Windows XP. > > /END CLIP > > > > Quaker Oats > > "...it's mmmm mmmm good" > -----BEGIN PGP SIGNATURE----- > Version: Hush 2.2 (Java) > Note: This signature can be verified at https://www.hushtools.com/verify > > wl8EARECAB8FAj5eQrgYHHF1YWtlcm9hdHNAaHVzaG1haWwuY29tAAoJEC2cw+XVsKna > mzsAniIHfWr3Cx1CXQipA1aF6FTlUf7ZAKCNL7udncX2CJFWvD4wPeC/UyVLng== > =pDoM > -----END PGP SIGNATURE----- > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
