MS Outlook/Outlook Express Preview Pane Security Issue

[Jeff Uslan]

------=_NextPart_000_0023_01C4131F.F90031F0
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable


FYI=20


Just a reminder that if you are using anything but Outlook 2003. The =
HTML
injection issues and other such exploits with just viewing the preview =
pane
have mostly been taken care of in the older versions but issues are =
still
popping up. If you want to use the preview pane I would recommend =
Outlook
2003 it has a greater security model and the preview pane will not =
execute
any HTML code or download any HTML embedded pictures unless you actually
tell it to on an e-mail by e-mail basis.

I believe some of these features will also be added to Outlook Express =
with
the release of XP SP2, but until then I'd steer clear of the preview =
pane on
older Outlook versions.


If your curious why you don't want embedded HTML pic's downloaded
automatically, this is a confirmation method used by spammers to verify =
you
received their e-mail and that your e-mail address is valid. =20


Regards,


Jeff Uslan, CISM, DHS
Chief Information Security Officer
Absolute Computer Security Consulting
jeff_uslan@speakeasy.net
* 805.498.3568 office
* 805.218.3182 cell =20
=20

------=_NextPart_000_0023_01C4131F.F90031F0--

[Drew Copley]

=20

> -----Original Message-----
> From: Jeff Uslan [mailto:jeff_uslan@speakeasy.net]=20
> Sent: Friday, March 26, 2004 10:49 AM
> To: jeff_uslan@speakeasy.net
> Subject: MS Outlook/Outlook Express Preview Pane Security Issue
>=20
>=20
> FYI=20
>=20
>=20
> Just a reminder that if you are using anything but Outlook=20
> 2003. The HTML
> injection issues and other such exploits with just viewing=20
> the preview pane
> have mostly been taken care of in the older versions but=20
> issues are still
> popping up. =20

'HTML injection issues and "other such exploits" with "justing viewing"
the email have been cropping up in older versions'... this does not mean
they will not happen in Outlook 2003.

There should definitely be some such bugs in Outlook 2003. There is a
lot of ground to cover where these situations could happen. (ie,
numerous message types, numerous automated functions -- just a lot of
code... and a past history... which gives us some probabilistic guess
about potential vulnerability.)

Outlook 2003 does provide numerous security enhancements, some which are
rather well hidden from users and a very nice Junk E Mail filter. Kudos
to them. [Though, they still have not figured out the simple task of
doing HTML email right. Or message threading. Another good indicator
there may be security bugs -- presence of poor or sloppy design issues
or non-security bugs.]

Outlook 2003 is not free, so expect it to be looked at later rather then
sooner by the larger body of security researchers.

[Nexus]

----- Original Message -----
From: "Jeff Uslan" <jeff_uslan@speakeasy.net>

[snip]

>Just a reminder that if you are using anything but Outlook 2003. The HTML
>injection issues and other such exploits with just viewing the preview pane
>have mostly been taken care of in the older versions but issues are still
>popping up. If you want to use the preview pane I would recommend Outlook
>2003 it has a greater security model and the preview pane will not execute
>any HTML code or download any HTML embedded pictures unless you actually
>tell it to on an e-mail by e-mail basis.

[snip]

By "anything but Outlook 2003" I assume you also mean Outlook Express; as
(IIRC) since IE6 SP1, it's as simple as Tools->Options->Read and check the
"Read all messages in plain text" box as this will also prevent any web bugs
and other HTML nonsense, regardless of how you view it. Granted that you
don't get to enjoy the shi^H^H^H wonderful experience that is HTML email,
but I can live with that ;-)

Cheers.