Suspect 'advisory' from someone claiming to be from Microsoft (was Fwd: Internet Security Update)

From: Marlon Borba (mborba1at_private)
Date: Sun Mar 10 2002 - 10:36:38 PST

  • Next message: Marcello Magnifico [fabbricadigitale]: "SMStools vulnerabilities in release before 1.4.8" 

    Fellow bugtraqers,

I received this 'advisory' in one of my e-mail addresses.
Since this differs A LOT from real Microsoft advisories I suspect someone 
is 'forging' alerts. This one came with an executable attachment (what 
Microsoft rarely does; usually MS suggests a place in his technical support 
site).
Be careful with fake 'advisories' like this, specially if they come with an 
'.exe' attached.

Cheers,

Marlon.

>X-Persona: <Marlon - STI>
>Received: by mail5.lc-3.la.inter.net (mbox marlon)
>  (with Cubic Circle's cucipop (v1.31 4.3 1998/05/13) Sun Mar 10 15:27:32 
> 2002)
>X-From_: mic_ykc@i-cable.com.hk  Sun Mar 10 10:36:32 2002
>Return-Path: <mic_ykc@i-cable.com.hk>
>Received: from sitar.i-cable.com (sitar.i-cable.com [210.80.60.11])
>         by mx5.lc-3.la.inter.net (8.9.3-d/8.9.3) with SMTP id KAA11731
>         for <marlonat_private>; Sun, 10 Mar 2002 10:36:26 -0300
>Date: Sun, 10 Mar 2002 10:36:26 -0300
>Message-Id: <200203101336.KAA11731at_private-3.la.inter.net>
>Received: (qmail 20871 invoked by uid 104); 10 Mar 2002 13:35:12 -0000
>Received: from cm61-10-73-119.hkcable.com.hk (HELO pfuckie) (61.10.73.119)
>   by 0 with SMTP; 10 Mar 2002 13:35:06 -0000
>From: "Microsoft Corporation Security Center" <rdquest12at_private>
>To: "Microsoft Customer" <'customerat_private'>
>Subject: Internet Security Update
>Reply-To: <rdquest12at_private>
>MIME-Version: 1.0
>Content-Type: multipart/mixed;
>         boundary="NextPart_000235"
>
>
>Microsoft Customer,
>
>      this is the latest version of security update, the
>
>known security vulnerabilities affecting Internet Explorer and
>MS Outlook/Express as well as six new vulnerabilities, and is
>discussed in Microsoft Security Bulletin MS02-005. Install now to
>protect your computer from these vulnerabilities, the most serious of which
>could allow an attacker to run code on your computer.
>
>
>Description of several well-know vulnerabilities:
>
>- "Incorrect MIME Header Can Cause IE to Execute E-mail Attachment" 
>vulnerability.

    This archive was generated by hypermail 2b30 : Mon Mar 11 2002 - 16:52:58 PST