[14117] in bugtraq
ms activex setup ctl exploit.
daemon@ATHENA.MIT.EDU (Mukund)
Wed Mar 1 18:55:05 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <38BD3AB3.25A22903@hd2.vsnl.net.in>
Date: Wed, 1 Mar 2000 21:13:47 +0530
Reply-To: Mukund <muks@HD2.VSNL.NET.IN>
From: Mukund <muks@HD2.VSNL.NET.IN>
X-To: bugtraq@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM
hi. this is my first posting to bugtraq.
a complete description of the microsoft active setup control's
unsigned cab file execution vulnerability and exploit is published
on securityfocus. you may want to check this out.
this is a sad vulnerability. one can actually transfer an EXE file
to the other side and get it executed without the user's knowledge.
http://www.securityfocus.com/data/vulnerabilities/exploits/775.html
an alternate address is:
http://www.crosswinds.net/~muks/
SHORT MESSAGE: if you use outlook express,
download the patches for the above off microsoft's
site and install them. or turn off all activex controls in your
security settings of outlook express. better yet, change your
mail client.
this exploit is published at
http://www.securityfocus.com/bid/775/
cheers!
mukund
