full-disclosure - Administrivia: Testing Emergency Virus Filt er..

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: david.vincent at mightyoaks.com (David Vincent)
Subject: Administrivia: Testing Emergency Virus Filt
	er..

> Outlook 2002 by default removes all attached executable files from
> incoming email messages.  The Outlook security update, which has been
> available for more than 2 years, provides the same feature for Outlook
> 98 and 2000.  
> 
> Outlook Express 6 also offers this same executable stripping feature,
> but Microsoft stupidly made the default be off.  Some computer makers
> saw the errors of Microsoft's ways are now turning on the stripping
> feature in Outlook Express, before their Windows boxes leave the
> factory.  Unfortunately, I've now seen recommendations in 
> both PC World and PC Magazine to turn this feature back off.

try again:

http://support.microsoft.com/default.aspx?scid=kb;en-us;q329570

SYMPTOMS

After you install Internet Explorer 6 Service Pack 1 (SP1) or Windows XP SP1
(both of which include Outlook Express 6 SP1), access to some of your e-mail
attachments in Outlook Express may be removed. For example, you may
experience any of the following symptoms: 

When you click the paper clip in the Preview pane, the Save Attachments and
file_name commands are unavailable.

When you open an e-mail message, the Save Attachments command is unavailable
on the File menu, the Attach field is missing from the e-mail message, and
the following message is displayed in the message alert bar at the top of
the e-mail message:

Outlook Express removed access to the following unsafe attachments in your
email: file_name1, file_name2

CAUSE

This behavior occurs if the Do not allow attachments to be saved or opened
that could potentially be a virus option is enabled, and the e-mail
attachment is determined by Outlook Express to be "unsafe". By default, the
Do not allow attachments to be saved or opened that could potentially be a
virus option is enabled in Outlook Express 6 SP1. When this virus-protection
feature is enabled, Outlook Express uses the Internet Explorer unsafe file
list and the Confirm open after download setting in Folder Options to
determine if a file is safe. Any e-mail attachment with a file type that is
reported as "unsafe" is not downloaded, and access to the attachment is
removed.