Bugtraq mailing list archives
Re: Outlook winmail.dat
From: Signal 11 <signal11 () MEDIAONE NET>
Date: Thu, 24 Aug 2000 23:06:27 -0500
formatting in your Outlook client). However they do not document what is contained in winmail.dat. Upon contacting secure@microsoft about this (4 months ago) I was informed a KB article detailing the contents of winmail.dat would be forthcoming (I cannot yet locate anything on their site).
Yes, that KB article is on display on the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of the Leopard.' In other words, no such article exists.
As a side note it would be an interesting excercise to see if Outlook is susceptible to a message with a malformed winmail.dat attached. One could theoretically use winmail.dat to hit on holes in either Outlook itself, or the Outlook RTF engine (Outlook does not use the same RTF engine as Wordpad).
My mail is sent via SMTP to a server in my domain (the server is Qmail's SMTP daemon) and then fed back to me over imapv4, the file appears as an attachment. The outlook client makes no attempt to interpret the file, and I can even save it to the desktop. It would be difficult to exploit something that Outlook does not process. I have Outlook 2000 as well (see message headers for the version), and was not able to reproduce this. ~ Signal 11
Current thread:
- Outlook winmail.dat Bryce Walter (Aug 24)
- Re: Outlook winmail.dat Signal 11 (Aug 25)
- xchat Joseph Nicholas Yarbrough (Aug 28)
- Re: Outlook winmail.dat John D. Hardin (Aug 25)
- Re: Outlook winmail.dat Signal 11 (Aug 25)