bugtraq - Re: MS Outlook/Outlook Express Preview Pane Security Issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20040326224858.E5E3419E866@cattie-brie>
Date: Fri, 26 Mar 2004 22:49:30 -0000
From: "Nexus" <nexus@...rol.i-way.co.uk>
To: "Jeff Uslan" <jeff_uslan@...akeasy.net>,
	<bugtraq@...urityfocus.com>
Subject: Re: MS Outlook/Outlook Express Preview Pane Security Issue

----- Original Message ----- 
From: "Jeff Uslan" <jeff_uslan@...akeasy.net>

[snip]

>Just a reminder that if you are using anything but Outlook 2003.  The HTML
>injection issues and other such exploits with just viewing the preview pane
>have mostly been taken care of in the older versions but issues are still
>popping up.  If you want to use the preview pane I would recommend Outlook
>2003 it has a greater security model and the preview pane will not execute
>any HTML code or download any HTML embedded pictures unless you actually
>tell it to on an e-mail by e-mail basis.

[snip]

By "anything but Outlook 2003" I assume you also mean Outlook Express; as
(IIRC) since IE6 SP1, it's as simple as Tools->Options->Read and check the
"Read all messages in plain text" box as this will also prevent any web bugs
and other HTML nonsense, regardless of how you view it.   Granted that you
don't get to enjoy the shi^H^H^H wonderful experience that is HTML email,
but I can live with that ;-)

Cheers.