Can anyone verify this, coz I have some installations with Outlook 2003 and I dont seem to see any files copied to the Local Settings\Temp when using the img tag.
On Sun, 9 May 2004, [EMAIL PROTECTED] wrote: > Date: Sun, 9 May 2004 23:31:08 -0000 > From: "[EMAIL PROTECTED]" <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > Subject: [Full-Disclosure] OUTLOOK 2003: OuchLook > > > > Sunday, May 09, 2004 > > Outlook 2003 the premier mail client from the company > called 'Microsoft' certainly appears to have a lot of security > features built into it. Curosry examination shows excellent > thought into 'spam' containment, 'security' consideration and > many other little 'things'. > > However there is a fundamental flaw with this particular device. > That is, it copies our arbitrary file with given name into a > known and easily reachable location: > > <img src="malware.htm" style="display:none"> > > when embedded into the body of a mail message and when the > recipient replies, will copy itself into temp folder: > > C:\Documents and Settings\<user name>\Local > Settings\Temp\malware.htm > > This location can be quite easily reached without having to know > the user name [courtesy of jelmer]: > > <a href="shell:user profile\\local > settings\\temp\\malware.htm">http://office.microsoft.com/</a> > > The scenario is 'painstakingly' trivial. Send your co-hort at > the office an email that requires a reply. Embed in it, an html > file out of sight. Either send them a second message with any > number of 'spoofed' url schemes pointing to the file in the > temp, or, direct them to a web site which will reach in into the > temp folder via the same url and install and run our malicious > software. > > > Very Silly Design Error. > > End Call > > -- > http://www.malware.com > > > > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
