full-disclosure - MS-Windows ME IE/Outlook/HelpCenter critical vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20030227092459.59262e54.fozzy@dmpfrance.com>
From: fozzy at dmpfrance.com (Fozzy [Hackademy Audit])
Subject: MS-Windows ME IE/Outlook/HelpCenter critical
 vulnerability

Hi,

My statement was unclear with respect to Windows XP. I included this information about WinXP just for the record, to show that there is yet another vulnerability that could affect people running unpatched installations of  WinXP. I did not wanted to confuse people into thinking that up-to-date WinXP boxes have another hole.

So my statement about WinXP should read :
- if you run Windows XP unpatched, "out of the box", it is vulnerable to this issue (and, obviously, many other ones)
- if you did apply MS02-060 patch (also included in SP1 ?), which makes the Help Center behave very differently, you are _safe_.

I believe this is true. However, I am not a WinXP user, and I tried that 3 months ago, so I may be wrong or unclear. If someone has more accurate information, please post it on the list.

Also, a guy from Microsoft told me Windows 2000 does not have an Help Center, so obviously Win2000 should not be affected by this issue.


Fozzy


On Thu, 27 Feb 2003 08:55:23 -0800
"Quaker Oats" <quakeroats@...hmail.com> wrote:

> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> Fozzy,
> 
> If you read MSFT's advisory, it seems as though they don't believe Windwos XP is vulnerable at all. This runs counter to what you're saying. What's the deal?
> 
> 
> - -----Original Message-----
> From: Fozzy [Hackademy Audit] [mailto:fozzy@...france.com]
> Sent: Thursday, February 27, 2003 12:08 AM
> To: full-disclosure@...ts.netsys.com
> Subject: [Full-Disclosure] MS-Windows ME IE/Outlook/HelpCenter critical
> vulnerability
> 
> 
> /BEGIN CLIP
> 
> 
> - --[ Affected Systems ]--
> 
> - - Windows ME (any version)
> - - Windows XP without SP1
> 
> Not vulnerable :
> - - Windows XP with SP1
> 
> Status of Windows 2000 was not tested but is believed to be the same as
> Windows XP.
> 
> /END CLIP
> 
> 
> 
> Quaker Oats
> 
> "...it's mmmm mmmm good"
> -----BEGIN PGP SIGNATURE-----
> Version: Hush 2.2 (Java)
> Note: This signature can be verified at https://www.hushtools.com/verify
> 
> wl8EARECAB8FAj5eQrgYHHF1YWtlcm9hdHNAaHVzaG1haWwuY29tAAoJEC2cw+XVsKna
> mzsAniIHfWr3Cx1CXQipA1aF6FTlUf7ZAKCNL7udncX2CJFWvD4wPeC/UyVLng==
> =pDoM
> -----END PGP SIGNATURE-----
>