[Esd-l] Outlook 2003 exploit using active scripting.

[Smart,Dan]

 I'm not mangling html files, but I have NOT set SECURITY_TRUST_HTML.  So I
take it this takes care of this vulnerability?

<<Dan>>

| -----Original Message-----
| From: John D. Hardin [mailto:jhardin at impsec.org] 
| Sent: Thursday, May 20, 2004 8:39 AM
| It uses an "embedded OLE object" so it sounds like it should 
| be defanged unless you have set SECURITY_TRUST_HTML, but 
| without seeing a sample I can't be sure.
| 
| Also, HTML file attachments are considered executable by 
| default and will be mangled.