If your vulnerability deals with the "Office Web Components" then no warning should be necessary at this point, since Microsoft already yanked the OWC downloads (both OWC 9 and 10) from their download pages back in April when GreyMagic Software uncovered several vulnerabilities in them. >From their download page ( http://office.microsoft.com/downloads/2002/owc10.aspx ): "Microsoft has temporarily removed the Office Web Components while we conduct an investigation of potential security vulnerabilities. At the completion of our investigation, the OWC will be reposted. Thank you for your patience." Appareantly, researching these vulnerabilities must be very hard on MS (despite their simplicity) since this has been so for a quarter of a year by now. The vulns that triggered this action: http://sec.greymagic.com/adv/gm005-ie/ http://sec.greymagic.com/adv/gm006-ie/ http://sec.greymagic.com/adv/gm007-ie/ http://sec.greymagic.com/adv/gm008-ie/ And again, these are still unpatched together with the total of 21 publicly known unpatched vulnerabilities currently found in IE: http://www.pivx.com/larholm/unpatched/ Of course, if you have installed Office by itself then you probably already have OWC installed. Luckily this can be uninstalled separately by going to ControlPanel - Add/Remove programs - Office - Change - Office Tools - Office Web Components. If a system administrator installed OWC from a network share, then OWC will be silently re-installed when used again - in which case you are out of luck. If your vulnerability did not deal with OWC, then apologize my intrusion and let me guess on a Content-Type/Content-Disposition variant - though your suggested workaround would make no sense then :) Regards Thor Larholm, Security Researcher PivX Solutions, LLC Are You Secure? http://www.PivX.com -----Original Message----- From: Georgi Guninski [mailto:guninski@GUNINSKI.COM] Sent: 30. juli 2002 16:36 To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM Subject: warning Consider this a warning, full details to come soon. windows + ie 6.0 + office xp may get owned by visiting a web page. workaround/solution: disable "activex and plugins" until someone produce a patch. After this warning, don't whine about responsibity issues - first check microsoft's responsiblity in "help -> about" Georgi Guninski http://www.guninski.com
