From: Michael Garriss <mgarriss@...>
Date: 2003-09-20T00:19:10+09:00
Subject: Re: Viruses

Rasputin wrote:

>* Peter Hickman <peter@semantico.com> [0949 14:49]:
>  
>
>>Peter wrote:
>>    
>>
>>>I'm getting incredibly many virus warnings because of mails I get from
>>>people I've never heard of. I'm pretty sure the reason is my recent
>>>postings on this ruby mailing list. Could everyone with a windows pc
>>>please check whether his or hers pc is infected with this virus. You're
>>>not just disturbing me, but many others (basically everyone who has posted
>>>on the mailing list and whose mails are in your mailbox). The following
>>>page gives you information about the virus you're trying to send me
>>>unwillingly and tells you how to get rid of it:
>>>
>>> http://us.mcafee.com/virusInfo/default.asp?id=helpCenter&hcName=swen
>>>      
>>>
>
>I've been getting around 1 a minute for the last twenty-four hours.
>It's not specific to this list.
>
>Next one liner contest is to send mails to all these users saying
>'try not to click on every attachment you get sent, stupid!'
>  
>

 From Microsoft's web site:

"Because HTML e-mails are simply web pages, IE can render them and open 
binary attachments in a way that is appropriate to their MIME types. 
However, a flaw exists in the type of processing that is specified for 
certain unusual MIME types. If an attacker created an HTML e-mail 
containing an executable attachment, then modified the MIME header 
information to specify that the attachment was one of the unusual MIME 
types that IE handles incorrectly, IE would launch the attachment 
automatically when it rendered the e-mail."


"An attacker could use this vulnerability in either of two scenarios. 
She could host an affected HTML e-mail on a web site and try to persuade 
another user to visit it, at which point script on a web page could open 
the mail and initiate the executable. Alternatively, she could send the 
HTML mail directly to the user. In either case, the executable 
attachment, if it ran, would be limited only by user�s permissions on 
the system."

No clicky needed! Gotta love IE5

Michael