"Security hole"?

"Security hole"?

Posted Oct 13, 2003 7:45 UTC (Mon) by diegor (guest, #1967)
In reply to: "Security hole"? by TwoTimeGrime
Parent article: E-mail filters not fooled by signed spam (News.com)

It's a old Outlook express bugs. I don't know exactly where is fixed. BTW:
the trick is that outlook was configured in highly insecure way, so the autopreview open any attachment that looks like a image.

So if you made an attachment that is a executable, named pippo.gif.exe (to fool the user) and mime type 'image/gif', outlook open it using run32.dll.

But run32dll it recognizes that it is an executable, and run it. Be happy, the nice autopreview feature have installed a new virus, even if you haven't clicked on the image....

The problem with outlook (and many other office program) is that until now they are not designed with security in mind.

Regards,
Diego.

---

(Log in to post comments)