RE: HTML FORMATED MAIL ( ie - oe - html ) bgsou nd local file - ding?

[Joshua Thomas <JThomas () poweronemedia com>]

Do you have an exploit example for this that is anything other than just an
annoyance?

Joshua Thomas
Network Operations Engineer
PowerOne Media, Inc.
tel: 518-687-6143
jthomas () poweronemedia com 
-----Original Message-----
From: morning_wood [mailto:se_cur_ity () hotmail com]
Sent: Monday, August 04, 2003 7:55 PM
To: incidents () securityfocus com; 0day; full-disclosure () lists netsys com
Subject: [Full-disclosure] HTML FORMATED MAIL ( ie - oe - html ) bgsound
local file - ding?


ding ding ding <--- its a local file
this should work reading FROM hotmail as well or any web ( html ) based
mail reader ( i think ) 
the tag <BGSOUND> carries many optopns as well, and referenced at
http://msdn.microsoft.com/workshop/author/dhtml/reference/objects/bgsound.as
p
this is calling c:\windows\media\ding.wav ( 9x / XP ) and
c:\winnt\media\ding.wav
this affects Microsft Win9x / NT / 2K / XP / 200? is this an annoyance or
bug? 
Donnie Werner
morning_wood () e2-labs com
http://e2-labs.com 
 view this online at http://exploit.philez.com/ding.htm
 t'nks buRdeN fer the test'n