WC:>: more details on Eudora security hole

[Barry Lee Brisco]

At: http://www.mercurycenter.com/premium/business/docs/internet07.htm

This piece has a bit more detail than the other one I sent.

-----------------------------------------------------------
Security hole is discovered on another e-mail program

New York Times
SAN FRANCISCO -- Just days after a serious security flaw was revealed in two popular electronic mail programs, an equally troubling vulnerability has been discovered in Eudora, the most widely used of all e-mail software.
- - - snip - - -
The flaw is found in Eudora versions 4.0 and 4.0.1 as well as in 4.1, a version being circulated in test form. Qualcomm is a San Diego-based telecommunications company.
In all, market researchers estimated Thursday that there are more than 18 million copies of the commercial and free versions of the Eudora program in use, only a small portion of which are version 4.0 or 4.0.1. The security flaw is present in the Windows version of Eudora, but not in the Macintosh version, which has fewer features, enabling it to take advantage of Web-based programming code from within an e-mail message.
-----------------------------------------------------------

This doesn't make sense to me. In the Mac version of Eudora Pro V4, I can click a URL in an email and launch my browser and access the web page. In fact, the Mac version has a number of great features that the Windows version doesn't have. This journalist doesn't have his facts right, IMO.


-----------------------------------------------------------
The Eudora vulnerability is a direct descendant of the ancient Trojan Horse deception in which a seemingly harmless item harbors great danger. In the modern version, a malevolent program is masked by a seemingly benign pointer known as a universal resource locator, or URL, which is the fundamental underpinning of the World Wide Web.
Clicking on a URL with a mouse button is supposed to take the user to a page on the Web, but if this flaw were exploited, the user could unknowingly launch a malicious program.
-----------------------------------------------------------

Okay, at least now I understand that the "security hole" is not coming from attached files, as the other article stated.

-----------------------------------------------------------
The Eudora vulnerability is linked to the Internet Explorer browser software that Microsoft integrated into the most recent versions of its operating system, Windows 95 and Windows 98. As a result Eudora programmers used the browser capability within the operating system rather than coding their own.
-----------------------------------------------------------

So it's all MS IE's fault is it? Hmm... <G>
Barry <mailto:[EMAIL PROTECTED]>
Web Design & Development - Online Marketing <http://www.ToTheWeb.com>

In a world without walls or fences, what use do we have for windows or gates?