'cross site scripting' CERT advisory and MS

From: Eric Lecht (vinyloneat_private)
Date: Tue Feb 08 2000 - 05:39:28 PST

  • Next message: Tim Adam: "Re: Evil Cookies."

    This is a multi-part message in MIME format.
    
    ------=_NextPart_000_0022_01BF71FF.3FBD1A20
    Content-Type: text/plain;
    	charset="iso-8859-1"
    Content-Transfer-Encoding: quoted-printable
    
    Mark Slemko wrote:
    
    >>>2. Do not use a mail reader that forces you to display HTML messages.
    Using something like Outlook Express is very dangerous, since it
    means that you can be exploited if an email message arrives in your
    inbox and is displayed.  If you do use something like Outlook
    Express, be sure to configure it to disable scripting and make it
    as restrictive as possible.  Unfortunately, in the case of Outlook
    Express, this doesn't appear to be enough since I can't find any
    setting that will stop things like IFRAMEs from automatically
    loading, which are enough to make you vulnerable in many situations.
    Hopefully I'm missing something.<<<
    
    I wrote Microsoft a few days ago asking about shutting off HTML in =
    Outlook Express, and here's what they wrote back:
    
    >>>>CASE_ID_NUM: SRZ000203000844
    MESSAGE:=20
    ********************** The message for you follows =
    ************************
    Eric,
    
    I am afraid that inbound functionality for turning off html code is not
    possible in Internet Explorer as default.=20
    
    There is no pure "html" to "text" converter or selection within the
    application. It is unfortunate, I know, and I am sorry to have to =
    deliver
    this message to you.
    
    I have however, passed your issue along to members of our development =
    staff
    for that feature to be included in future revisions. The very question =
    you
    ask is being considered at the most critical levels of our development
    process.=20
    
    The current conventional logic behind why we do not have a html to text
    converter is the overhead that would be placed on the machine, browser =
    and
    email app that would seriously hinder performance.
    
    I appreciate the your time and patience while I have researched your
    question. I will be archiving this issue as unresolved. If you have any
    questions, please contact me.
    
    Thank you in advance,
    harryb
    
    Harry Bynum
    North Carolina Desktop Premier Support Team
    IE,IEAK,Win 9x/3.x!
    Phone:704-XXX-XXXX
    Email: hXXXat_private
    
    Powering Up the Desktop! <<<<
    
    The gentleman who responded to my query did so promptly, and from what I =
    gather from his wording (I am afraid that inbound functionality for =
    turning off html code is not possible in Internet Explorer as default.) =
    I would hazard that OE is inexorably tied to IE (ok, i'm not a =
    programmer, just hazarding a guess...) just like IE has deep hooks into =
    Windows itself, hence the inability to _disable_ reading html in basic =
    email. In fact I had limited my inquiry to turning HTML off in OE.
    
    FYI....
    
    Eric Lecht
    Network Analyst
    State of Idaho
    Dept. of Administration
    
    "I do what I can, I work in the dark".
    
    
    
    
    ------=_NextPart_000_0022_01BF71FF.3FBD1A20
    Content-Type: text/html;
    	charset="iso-8859-1"
    Content-Transfer-Encoding: quoted-printable
    
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
    <HTML><HEAD>
    <META content=3D"text/html; charset=3Diso-8859-1" =
    http-equiv=3DContent-Type>
    <META content=3D"MSHTML 5.00.2919.6307" name=3DGENERATOR>
    <STYLE></STYLE>
    </HEAD>
    <BODY bgColor=3D#ffffff>
    <DIV><FONT size=3D2>Mark Slemko wrote:</FONT></DIV>
    <DIV>&nbsp;</DIV>
    <DIV><FONT size=3D2>&gt;&gt;&gt;2. Do not use a mail reader that forces =
    you to=20
    display HTML messages.<BR>Using something like Outlook Express is very=20
    dangerous, since it<BR>means that you can be exploited if an email =
    message=20
    arrives in your<BR>inbox and is displayed.&nbsp; If you do use something =
    like=20
    Outlook<BR>Express, be sure to configure it to disable scripting and =
    make=20
    it<BR>as restrictive as possible.&nbsp; Unfortunately, in the case of=20
    Outlook<BR>Express, this doesn't appear to be enough since I can't find=20
    any<BR>setting that will stop things like IFRAMEs from =
    automatically<BR>loading,=20
    which are enough to make you vulnerable in many situations.<BR>Hopefully =
    I'm=20
    missing something.&lt;&lt;&lt;</FONT></DIV>
    <DIV><FONT size=3D2></FONT>&nbsp;</DIV>
    <DIV><FONT size=3D2>I wrote Microsoft a few days ago asking about =
    shutting off=20
    HTML in Outlook Express, and here's what they wrote back:</FONT></DIV>
    <DIV><FONT size=3D2></FONT>&nbsp;</DIV>
    <DIV><FONT size=3D2>&gt;&gt;&gt;&gt;CASE_ID_NUM: =
    SRZ000203000844<BR>MESSAGE:=20
    <BR>********************** The message for you follows=20
    ************************<BR>Eric,<BR><BR>I am afraid that inbound =
    functionality=20
    for turning off html code is not<BR>possible in Internet Explorer as =
    default.=20
    <BR><BR>There is no pure "html" to "text" converter or selection within=20
    the<BR>application. It is unfortunate, I know, and I am sorry to have to =
    
    deliver<BR>this message to you.<BR><BR>I have however, passed your issue =
    along=20
    to members of our development staff<BR>for that feature to be included =
    in future=20
    revisions. The very question you<BR>ask is being considered at the most =
    critical=20
    levels of our development<BR>process. <BR><BR>The current conventional =
    logic=20
    behind why we do not have a html to text<BR>converter is the overhead =
    that would=20
    be placed on the machine, browser and<BR>email app that would seriously =
    hinder=20
    performance.<BR><BR>I appreciate the your time and patience while I have =
    
    researched your<BR>question. I will be archiving this issue as =
    unresolved. If=20
    you have any<BR>questions, please contact me.<BR><BR>Thank you in=20
    advance,<BR>harryb<BR><BR>Harry Bynum<BR>North Carolina Desktop Premier =
    Support=20
    Team<BR>IE,IEAK,Win 9x/3.x!<BR>Phone:704-XXX-XXXX</FONT></DIV>
    <DIV><FONT size=3D2>Email: <A=20
    href=3D"mailto:hXXXat_private">hXXXat_private</A><BR><BR>Powering=
     Up the=20
    Desktop! &lt;&lt;&lt;&lt;</FONT></DIV>
    <DIV><FONT size=3D2></FONT>&nbsp;</DIV>
    <DIV><FONT size=3D2>The gentleman who responded to my query did so =
    promptly, and=20
    from what I gather from his wording (I am afraid that inbound =
    functionality for=20
    <STRONG>turning off html code is not possible in Internet Explorer as=20
    default</STRONG>.) I would hazard that OE is inexorably tied to IE (ok, =
    i'm not=20
    a programmer, just hazarding a guess...) just like IE&nbsp;has deep =
    hooks into=20
    Windows itself, hence the inability to _disable_ reading html in basic =
    email. In=20
    fact I had limited my inquiry to turning&nbsp;HTML off in =
    OE.</FONT></DIV>
    <DIV><FONT size=3D2></FONT>&nbsp;</DIV>
    <DIV><FONT size=3D2>FYI....</FONT></DIV>
    <DIV><FONT size=3D2></FONT>&nbsp;</DIV>
    <DIV><FONT size=3D2>Eric Lecht</FONT></DIV>
    <DIV><FONT size=3D2>Network Analyst</FONT></DIV>
    <DIV><FONT size=3D2>State of Idaho</FONT></DIV>
    <DIV><FONT size=3D2>Dept. of Administration</FONT></DIV>
    <DIV><FONT size=3D2></FONT>&nbsp;</DIV>
    <DIV><FONT size=3D2>"I do what I can, I work in the=20
    dark".<BR><BR><BR></DIV></FONT></BODY></HTML>
    
    ------=_NextPart_000_0022_01BF71FF.3FBD1A20--
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:33:50 PDT