>From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]
<snip>
</snip>
>Also, I believe it is irrelevant to this security flaw. What I read from
Microsoft claimed >that it occured when the "Date: " header was corrupted.
They didn't mention HTML at all.
It's been an interesting day for MS because the date flaw is a completely
separate issue to the Access "IE Script" issue. This flaw is as bad as the
Access flaw if not worse because the user does not even have to preview the
email. The Date flaw is a traditional buffer overrun problem where clever
programmers can write code that will get executed, or not very clever
programmers can pick up one of the ready made samples that NT bug traq and
the rest have freely and publicly distributed. (Anyway that rant about
irresponsibility could go on for a while so i'll stop there :)
Steve
Steven Moore
Internet Development Engineer
Research Machines
+44 1235 823522
-----Original Message-----
Sent: 19 July 2000 14:06
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] FW: MS vulnerability
> I have started filtering out HTML mail by looking for the html
> tag and head tag (brackets removed so my filter doesn't block this)
FYI, blocking all HTML is a very risky practice. Although I'd love it if
HTML E-mail hadn't been invented, LOTS of people use it. Also, if you have
your E-mail client set up not to show the HTML, you usually WILL see the
message, just without the HTML, so you may not have an idea of how many
people really use it.
STANDARD DISCLAIMER: This message is confidential. You should not copy it or
disclose its contents to anyone. You may use and apply the information only
for the intended purpose. Internet communications are not secure and
therefore RM does not accept legal responsibility for the contents of this
message. Any views or opinions presented are only those of the author and
not those of RM. If this email has come to you in error please delete it and
any attachments.
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
