hebig.org/blog
Personal webnode of Haiko Hebig

From time to time people that think surfing with Mozilla and running Windows 2000 is unnecessary geeky behaviour reapproach me to ask if I finally had changed my mind and would now run this mighty fine new piece of MSFT software.

Good thing about MSFT software is that whatever timespan those compulsory askers let pass, someone already has found a new security hole that is even bigger than those before, so I just have to point my askers to the site describing the new hole. Example: Outlook 2003 in its default setting plus some HTML email. Result: "Silent delivery and installation of an executable on the target computer, no client input other than reading an email".

Even better, "full screen video advertisements on opening the mail message" comes as a free add-on. "In typical fashion despite the settings in the Windows Media Player being set to 'disallow' scripting in media files, despite Outlook 2003's 'highly' secure default setting of view html content in the so-called 'restricted zone'; it all still works!"

Via Phil Rignalda, the full Bugtraq report >