full-disclosure - Fw: warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <012c01c237df$d2dbf3a0$b48370d4@thor2k>
From: thor at pivx.com (Thor Larholm)
Subject: Fw: warning

----- Original Message -----
From: "Thor Larholm" <thor@...x.com>
To: <guninski@...inski.com>; <NTBUGTRAQ@...TSERV.NTBUGTRAQ.COM>;
<bugtraq@...urityfocus.com>
Sent: Tuesday, July 30, 2002 5:22 PM
Subject: RE: warning


> If your vulnerability deals with the "Office Web Components" then no
warning
> should be necessary at this point, since Microsoft already yanked the OWC
> downloads (both OWC 9 and 10) from their download pages back in April when
> GreyMagic Software uncovered several vulnerabilities in them.
>
> From their download page (
> http://office.microsoft.com/downloads/2002/owc10.aspx ):
> "Microsoft has temporarily removed the Office Web Components while we
> conduct an investigation of potential security vulnerabilities.  At the
> completion of our investigation, the OWC will be reposted. Thank you for
> your patience."
>
> Appareantly, researching these vulnerabilities must be very hard on MS
> (despite their simplicity) since this has been so for a quarter of a year
by
> now. The vulns that triggered this action:
>
> http://sec.greymagic.com/adv/gm005-ie/
> http://sec.greymagic.com/adv/gm006-ie/
> http://sec.greymagic.com/adv/gm007-ie/
> http://sec.greymagic.com/adv/gm008-ie/
>
> And again, these are still unpatched together with the total of 21
publicly
> known unpatched vulnerabilities currently found in IE:
>
> http://www.pivx.com/larholm/unpatched/
>
> Of course, if you have installed Office by itself then you probably
already
> have OWC installed. Luckily this can be uninstalled separately by going to
>
> ControlPanel -  Add/Remove programs - Office - Change - Office Tools -
> Office Web Components.
>
> If a system administrator installed OWC from a network share, then OWC
will
> be silently re-installed when used again - in which case you are out of
> luck.
>
> If your vulnerability did not deal with OWC, then apologize my intrusion
and
> let me guess on a Content-Type/Content-Disposition variant - though your
> suggested workaround would make no sense then :)
>
>
> Regards
> Thor Larholm, Security Researcher
> PivX Solutions, LLC
>
> Are You Secure?
> http://www.PivX.com
>
> -----Original Message-----
> From: Georgi Guninski [mailto:guninski@...INSKI.COM]
> Sent: 30. juli 2002 16:36
> To: NTBUGTRAQ@...TSERV.NTBUGTRAQ.COM
> Subject: warning
>
>
> Consider this a warning, full details to come soon.
> windows + ie 6.0 + office xp may get owned by visiting a web page.
> workaround/solution: disable "activex and plugins" until someone produce a
> patch.
> After this warning, don't whine about responsibity issues - first check
> microsoft's responsiblity in "help -> about"
>
> Georgi Guninski
> http://www.guninski.com
>