full-disclosure - Official IFRAME patch - make sure it installs correctly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: raoul at elforsoft.com (Raoul Nakhmanson-Kulish)
Subject: Official IFRAME patch - make sure it installs
 correctly

Hello, Berend-Jan Wever!

> The IFRAME vulnerability has been patched, see
> http://www.microsoft.com/technet/security/bulletin/ms04-040.mspx
Oh! Thanks, God!

Good that nobody has hit upon an idea until now about exploiting this to 
launch self-spreading mail virus without user interaction by putting 
iframe into HTML message body: this hole is exploitable even in 
restricted zone and millions of OE and Outlook lemmings would be doomed.

Such thought visited me nearly right away when I had known this issue.

-- 
Best regards,
Raoul Nakhmanson-Kulish
Elfor Soft Ltd.,
ERP Department
http://www.elforsoft.ru/