Vulnerability Development mailing list archives

accessing FileSystemObject from within an email message


From: spepper () WLU CA (Shelagh Pepper)
Date: Thu, 1 Jun 2000 09:02:00 -0400


Please note that the Microsoft patch does not prevent the use of ActiveX controls if the user allows scripts to run and 
clicks on "Yes" after a warning about unsafe ActiveX controls. 

This message will demonstrate the vulnerability for users (Outlook and Outlook express only?) who have the Windows 
Scripting host installed and enabled, and whose security settings are not optimal. 

If your email reader is vulnerable, a window will pop up informing you of the vulnerablity. The script will then create 
a few files on your hard drive, display the contents, and then delete the files. 

Shelagh 


Current thread: