[25080] in bugtraq
Re: w00w00 on Microsoft IE/Office for Mac OS
daemon@ATHENA.MIT.EDU (Kevin van Haaren)
Tue Apr 16 19:08:24 2002
Date: Tue, 16 Apr 2002 17:45:25 -0500
To: Matt Conover <shok@dataforce.net>
Cc: bugtraq@securityfocus.com
Message-ID: <20020416224525.GA15356@vanhaaren.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Pine.LNX.3.95.1020416082309.13566I-100000@cannabis.dataforce.net>
From: kevin@vanhaaren.net (Kevin van Haaren)
On Tue, Apr 16, 2002 at 10:52:02AM +0400, Matt Conover wrote:
> w00w00 (http://www.w00w00.org)
> Angry Packet Security (http://sec.angrypacket.com)
>
> Vulnerability in Multiple Microsoft Products for Mac OS
> HTML format: http://www.w00w00.org/advisories/ms_macos.html
> Text format: http://www.w00w00.org/files/advisories/ms_macos.txt
>
> SOFTWARE VERSIONS AFFECTED
>
> Microsft Internet Explorer
> Versions affected: 5.1
> Platforms affected: Mac OS 8, 9, and X
>
> Microsft Outlook Express
> Versions affected: 5.0.2
> Platforms affected: all Mac OS
>
> Microsft Entourage
> Versions affected: 2001 and X
> Platforms affected: all Mac OS
>
> Microsft PowerPoint
> Versions affected: 98, 2001, and X
> Platforms affected: all Mac OS
>
> Microsft Excel
> Versions affected: 2001 and X
> Platforms affected: all Mac OS
>
> Microsft Word
> Versions affected: 2001
> Platforms affected: all Mac OS
>
> PRELUDE
>
> A bug in Internet Explorer for Mac OS X was originally reported to
> Microsoft by Josha Bronson of Angry Packet Security on January 4,
> 2002.
>
> Due to some internal mishandling at Microsoft, this was brushed off
> until w00w00 informed Microsoft of its intention to release the
> information on February 17. We originally gave them a deadline of
> two weeks until we discovered that this affected Entourage (the
> Outlook-equivalent for Mac OS). When Microsoft determined this
> affected most of their Office suite on Mac OS, we felt it was
> appropriate to give them time to fix it.
>
Entourage is NOT the Outlook equivalent for the Mac. The Outlook equivalent for the Mac is Outlook 2001.
<http://www.microsoft.com/mac/products/outlook/outlook_default.asp?navindex=s13>
Entourage can not connect to an Exchange Server. Only Outlook 2001 (on the Mac) can. Entourage is more of a Outlook Express on steroids, POP3, IMAP and HotMail connections only.
<http://www.microsoft.com/mac/resources/resources_main.asp?EmbFName=chart.asp>
You don't appear to have tested this 3rd e-mail client for the mac (I don't have one handy to test on).
Kevin
