🚀 go-pugleaf

"Adam Warner" <Adam.Warner@xtra.co.nz> wrote in message
news:8jhds5$q2b$1@news.ihug.co.nz...
> Hi David,
>
> You'll appreciate this:
> http://www.microsoft.com/technet/security/bulletin/fq00-042.asp
>
> MS is classifying this as a DoS! "This is a denial of service
> vulnerability."
>
> And guess what:
> "I heard that something in Windows 2000 would help protect against this
> vulnerability. Is this true?
> Yes..."
>
> Microsoft-signed files are trusted by default. This and the ability to
> automatically download the files to a users hard disk at any location
allows
> any unprotected files (read: virtually all) to be overwritten.

IE objects made by Microsoft are trusted by IE (this actually makes sense).
All other object downloads (including Microsoft's) will display the
'certificate' window.

> ActiveX technology at its best.
>
> Guess what ones of the things that the patch does:
>
> "It changes the Active Setup Control so that it treats Microsoft-signed
> content exactly like content from any other software issuer."
>
> I'd be interested in hearing from MS why their content got special
> privileges in the first place!
>
> Regards,
> Adam
>
>