Re: gmx.net

From: Thomas Roeder (troeder@gmx-ag.de)
Date: Tue Jun 12 2001 - 06:18:29 PDT

Next message: IT Resource Center : "security bulletins digest"

Previous message: Jeffrey W. Baker: "Re: [PkC] Advisory #005: Default Slackware 7.1 installation /etc/shells perms bug"
Maybe in reply to: rudi carell: "gmx.net"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

rudi carell < rudicarellat_private > wrote:

> like many other web-mail systems gmx.net has a problem filtering
> java-script in html-based mail-messages.
[...]
> the html - <img> tag can be used to embedd malicious java-scripts
> within html-mails

thanks for letting us know. A workaround will go online in the next
minutes. I would like to add that we display HTML-based message
content in a special security window (called "Volldarstellung" = full
display mode) which doesn't contain the session ID of the logged in
user. Therefor it shouldn't be possible to compromise the users
account on our system by such tricks.

I agree though that it would be possible to open a relogin-trojan
which could be confusing to users with less security awareness. That's
the reason why we normally try to supress scripting code. That one
passed by us though ...

Greetings from Munich,

Thomas Roeder
GMX AG, Product Management

Next message: IT Resource Center : "security bulletins digest"
Previous message: Jeffrey W. Baker: "Re: [PkC] Advisory #005: Default Slackware 7.1 installation /etc/shells perms bug"
Maybe in reply to: rudi carell: "gmx.net"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Jun 12 2001 - 10:25:41 PDT