Re: warningFrom: Thor Larholm (thor@PIVX.COM)
- Previous message: Georgi Guninski: "warning"
- Maybe in reply to: Georgi Guninski: "warning"
- Next in thread: Georgi Guninski: "Re: warning"
- Reply: Georgi Guninski: "Re: warning"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 30 Jul 2002 17:22:20 +0200 From: Thor Larholm <thor@PIVX.COM> To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
If your vulnerability deals with the "Office Web Components" then no warning
should be necessary at this point, since Microsoft already yanked the OWC
downloads (both OWC 9 and 10) from their download pages back in April when
GreyMagic Software uncovered several vulnerabilities in them.
>From their download page (
"Microsoft has temporarily removed the Office Web Components while we
conduct an investigation of potential security vulnerabilities. At the
completion of our investigation, the OWC will be reposted. Thank you for
Appareantly, researching these vulnerabilities must be very hard on MS
(despite their simplicity) since this has been so for a quarter of a year by
now. The vulns that triggered this action:
And again, these are still unpatched together with the total of 21 publicly
known unpatched vulnerabilities currently found in IE:
Of course, if you have installed Office by itself then you probably already
have OWC installed. Luckily this can be uninstalled separately by going to
ControlPanel - Add/Remove programs - Office - Change - Office Tools -
Office Web Components.
If a system administrator installed OWC from a network share, then OWC will
be silently re-installed when used again - in which case you are out of
If your vulnerability did not deal with OWC, then apologize my intrusion and
let me guess on a Content-Type/Content-Disposition variant - though your
suggested workaround would make no sense then :)
Thor Larholm, Security Researcher
PivX Solutions, LLC
Are You Secure?
Consider this a warning, full details to come soon.
windows + ie 6.0 + office xp may get owned by visiting a web page.
workaround/solution: disable "activex and plugins" until someone produce a
After this warning, don't whine about responsibity issues - first check
microsoft's responsiblity in "help -> about"