full-disclosure - Anyone? Important Security Update for the .NET Messenger Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <004c01c36692$513dd150$2b02a8c0@dcopley>
From: dcopley at eeye.com (Drew Copley)
Subject: Anyone?  Important Security Update for the .NET Messenger Service

Yeah, it's real, but it also highlights that they are not paying
attention. Notice how nowhere in this page is there a mention of what
this security issue is. This is typical with MSN updates. There will
probably be an advisory released with technical info. Or will there not
be? 

I have found several issues in 4.7 client. Problem is you would have to
hijack a server to use them because the server between the clients
strongly prohibits overly long strings. Further, their latest version
has fixed these issues for some months now. So what is new? It sounds
like there is something new and nasty with the whole Passport system
through MSN... But, they do not say. 

> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com 
> [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of 
> Chris DeVoney
> Sent: Tuesday, August 19, 2003 12:49 PM
> To: full-disclosure@...ts.netsys.com
> Subject: RE: [Full-Disclosure] Anyone? Important Security 
> Update for the .NET Messenger Service
> 
> 
> > Anyway, I'm pretty sure it's some kind of spam or whatever. But it 
> > seemed so valid, it makes you wonder about it...
> 
> >From another list answering the identical question, Mary Jo 
> Foley who 
> >write
> the Ziff-Davis Microsoft Watch newsletter:
> 
> It's real, but Microsoft is unfortunately spamming
>  folks with the message.
> 
> Here's the real update page: 
> http://messenger.msn.com/Help/Upgrades.aspx
> 
> And more info. 
> available here: http://www.msnfanatic.com/
> 
> And here: http://www.theinquirer.net/?article=11110
> 
> MJF
> 
> cdv
> 
> ------------------------
> Chris DeVoney
> Clinical Research Center Informatics
> University of Washington
> ------------------------
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>