🚀 go-pugleaf

----------------------------Original message----------------------------
At 12:49 PM 8/26/96 EDT, you wrote:
>----------------------------Original message----------------------------
>From: NAME: Mike Hennessy
> FUNC: Specialty Chemicals
> TEL: 540-4376 FAX 540-2344            <HENNESMJ AT A1 AT JLCL01>
>To: NAME: LABMGR@LSV.UKY.EDU <"LABMGR@LSV.UKY.EDU"@ESDS01@MRGATE@JLCL01>
>
>
>Please see attachment!
>
>
>
>From: NAME: William L. Halberstadt
<HALBERST@A1.ESVAX.UMC.DUPONT.COM@UMC
>Date: 21-Aug-1996
>Posted-date: 21-Aug-1996
>Precedence: 1
>Subject: POSSIBLE EXPLORER SECURITY PROBLEM ON PC'S
>To: WWW@EPLRX7.ES.DUPONT.COM@UMC@ESVAX
>
>
>[This message is converted from WPS-PLUS to ASCII]
>
>>From the "comp.risks" USENET forum....
>
>Date: Wed, 21 Aug 1996 13:12:59 -0400
>From: felten@CS.Princeton.EDU (Ed Felten)
>Subject: Internet Explorer Security Problem
>
>We have discovered a security flaw in the current version (3.0) of
>Microsoft's Internet Explorer browser running under Windows 95.  An attacker
>could exploit the flaw to run any DOS command on the machine of an Explorer
>user who visits the attacker's page.  For example, the attacker could read,
>modify, or delete the victim's files, or insert a virus or backdoor entrance
>into the victim's machine.  We have verified our discovery by creating a Web
>page that deletes a file on the machine of any Explorer user who visits the
>page.
>
>The core of the attack is a technique for delivering a document to the
>victim's browser while bypassing the security checks that would normally be
>applied to the document.  If the document is, for example, a Microsoft Word
>template, it could contain a macro that executes any DOS command.
>
>Normally, before Explorer downloads a dangerous file like a Word document,
>it displays a dialog box warning that the file might contain a virus or
>other dangerous content, and asking the user whether to abort the download
>or to proceed with the download anyway.  This gives the user a chance to
>avoid the risk of a malicious document.  However, our technique allows an
>attacker to deliver a document without triggering the dialog box.
>
>Microsoft has been notified and they are working on fixing the problem.
>Until a remedy is widely available, we will not disclose further details
>about the flaw.
>
>For more information, contact Ed Felten at felten@cs.princeton.edu or
>609-258-5906.
>
>Dirk Balfanz and Ed Felten
>Dept. of Computer Science, Princeton University
>http://www.cs.princeton.edu/sip/
>
>
>
The fix can be downloaded from ftp.microsoft.com or
http://www.windows95.com/apps/patches.html
Don M.