[Dshield] An unfixed highly critical vulnerability discoveredinMicrosoft ...

WMAVT@aol.com WMAVT at aol.com
Mon Apr 12 14:25:42 GMT 2004

OK Take it to the Next level!
                  I have use 98Lite for years, Mozilla as default browser. If 
you need IE it can be reloaded BUT runs as any other program. 
                   I Just downloaded XPlite, We shall see. If it helps winXp 
Pro 1/2 as much as 98 Its worth every cent. 
              98Lite has a free version if you want to give it a try. If you 
do not like it just run 98 set up again/do a load over [ya I know] But it 
works as all you are doing is replacing all the M$ Bug/spy/ect ware. 
            Get it here 

XPlite and 2000lite are powerful configuration utilities for Windows creating 
a modular Windows operating system where YOU are in control.

<A HREF="http://www.litepc.com/98lite.html">98lite</A> is our unique system utility to customize and tweak Windows9x for 
performance and embedded computers. Free demo available! 
                     Have fun Bill

========Original Message======== 
Subj:   RE: [Dshield] An unfixed highly critical vulnerability 
discoveredinMicrosoft Internet Explorer    
Date:   4/8/2004 3:02:31 PM Mountain Daylight Time  
From:    clewis at iquest.net (Chuck Lewis)
Sender:    list-bounces at lists.dshield.org
Reply-to: <A HREF="mailto:list at lists.dshield.org">list at lists.dshield.org</A> (General DShield Discussion List)
To:    list at lists.dshield.org ('General DShield Discussion List')

Here is something I got on another list I'm on after posting a warning about
this (and giving credit to the Dshield list):

" Yet another IE flaw to block w/eSafe.

And another unpatched flaw:

YaHoo and MSN have took steps against it, but
nothing stops me from using it in html email or
on one of my sites.

Do some searching and you can find many known and 
unfixed flaws in IE.  Many are there by design and
are not bugs!

Fool me once, shame on you.  Fool me twice, shame on me.
Why anyone still uses Internet Explorer for generic
web browsing is beyond me.


Select it's Icon, right click on it, click properties
and then advanced.  Run it under different creditials.
Create a generic user on your computer.  Give it access
to just about nothing (except the install dir and a few
other needed items) and you have a much safer web surfing environment.
Virtually free of Viruses, worms, and spyware."

But I also understand the statements about NOT dumping IE. We were Netscape
for as long as I could hold out. But that "when's the new release going to
come out" nightmare of a few years ago, coupled with key vendor sites not
working with Netscape turned out to be the "nails in the coffen".


-----Original Message-----
From: list-bounces at lists.dshield.org [mailto:list-bounces at lists.dshield.org]
On Behalf Of Laura Vance
Sent: Thursday, April 08, 2004 2:25 PM
To: General DShield Discussion List
Subject: Re: [Dshield] An unfixed highly critical vulnerability
discoveredinMicrosoft Internet Explorer

After reading the sites that reported it, it seems like there is really 
nothing to stop it, because it's using a "feature" of MSIE and 
MSOutlook.  It's supposed to be able to allow sites to pop up help 
windows that completely mimic the OS's help system so the user doesn't 
get all confused by different styles of help.  As long as web sites are 
allowed to store help files on the local machine, there is no safety 
net.  Unless they add security that doesn't allow web sites to put files 
on the local machine in a trusted location.  The description said that 
they didn't even have to store the help file on the local machine, all 
they had to do is provide a bogus help file name then an alternate help 
file from a web server somewhere, and when the bogus one failed, the 
Internet one is followed with local machine privilages executing 
whatever mailicious script is in it.

list mailing list
list at lists.dshield.org
To change your subscription options (or unsubscribe), see: 

----------------------- Headers --------------------------------
Return-Path: <list-bounces at lists.dshield.org>
Received: from  rly-yg06.mx.aol.com (rly-yg06.mail.aol.com []) 
by air-yg02.mail.aol.com (v98.19) with ESMTP id MAILINYG21-7894075bdd279; Thu, 
08 Apr 2004 17:02:31 -0500
Received: from  mail.giac.net (mail1.giac.net []) by 
rly-yg06.mx.aol.com (v98.5) with ESMTP id MAILRELAYINYG67-7894075bdd279; Thu, 08 Apr 
2004 17:02:11 -0500
Received: (qmail 28575 invoked from network); 8 Apr 2004 21:02:05 -0000
Received: from  (HELO dshield.com) (@)
  by 0 with SMTP; 8 Apr 2004 21:02:05 -0000
Received: from maverick12.sans.org (localhost.localdomain [])
    by dshield.com (8.11.6/8.11.6) with ESMTP id i38L0Gi31261;
    Thu, 8 Apr 2004 21:00:16 GMT
Received: from mail.giac.net (iceman1 [])
    by dshield.com (8.11.6/8.11.6) with SMTP id i38KvRi31142
    for <list at lists.dshield.org>; Thu, 8 Apr 2004 20:57:27 GMT
Received: (qmail 25631 invoked from network); 8 Apr 2004 20:57:25 -0000
Received: from mx-2.iquest.net (
    by 0 with SMTP; 8 Apr 2004 20:57:25 -0000
Received: (qmail 78318 invoked from network); 8 Apr 2004 20:57:25 -0000
Received: from datatransport-48-202.onecall.net (HELO GR43) (
    by mx-2.iquest.net with SMTP; 8 Apr 2004 20:57:25 -0000
From: "Chuck Lewis" <clewis at iquest.net>
To: "'General DShield Discussion List'" <list at lists.dshield.org>
Subject: RE: [Dshield] An unfixed highly critical vulnerability
    discoveredinMicrosoft Internet Explorer
Date: Thu, 8 Apr 2004 16:01:02 -0500
Message-ID: <009001c41dac$9a1bcc70$190a10ac at GR43>
MIME-Version: 1.0
Content-Type: text/plain;
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.6626
Importance: Normal
In-Reply-To: <4075A709.8020109 at winfreeacademy.com>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by dshield.com id
X-Mailman-Approved-At: Thu, 08 Apr 2004 20:59:24 +0000
X-BeenThere: list at lists.dshield.org
X-Mailman-Version: 2.1.4
Precedence: list
Reply-To: General DShield Discussion List <list at lists.dshield.org>
List-Id: General DShield Discussion List <list.lists.dshield.org>
List-Unsubscribe: <http://www.dshield.org/mailman/listinfo/list>,
    <mailto:list-request at lists.dshield.org?subject=unsubscribe>
List-Archive: <http://www.dshield.org/pipermail/list>
List-Post: <mailto:list at lists.dshield.org>
List-Help: <mailto:list-request at lists.dshield.org?subject=help>
List-Subscribe: <http://www.dshield.org/mailman/listinfo/list>,
    <mailto:list-request at lists.dshield.org?subject=subscribe>
Sender: list-bounces at lists.dshield.org
Errors-To: list-bounces at lists.dshield.org

More information about the list mailing list