Re: XP SP3 Update, Outlook 2002

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Pat (pkeller8_at_comcast.net)
Date: 03/14/04 

Date: Sun, 14 Mar 2004 07:17:11 -0800

I understand that identifying a calling program at
execution would be 'restricted' for security reasons. As
it should be. Would it not have been possible during
*installation*, however, to inspect registered
plugins/dlls to at least warn the user that this problem
might occur if installation continues. I would suggest
that if motivated to do so, well-designed software could
still include a way to allow specific and known
exceptions without compromising security. As it exists,
the warning message is worthless. How can anyone make a
decision to 'Allow' or not, when there is no information
on which to base that decision.

>-----Original Message-----
>FWIW, the security prompts are not a new issue. This
security feature in
>Outlook was introduced nearly 4 years ago. It has
*never* been possible to
>know which program is accessing a blocked property or
method; it's just not
>technically feasible, according to Microsoft (whose own
programs are subject
>to the same restrictions), within the existing Outlook
programming context.
>
>What's new in SP3 is the restriction of several
properties that were
>previously unrestricted, leaving Outlook vulnerable to
address harvesting by
>malicious programs. SP3 closes that security gap.
>
>If an anti-virus program is triggering the prompts, you
can turn its email
>checking without losing any protection (and possibly
gaining some overall
>performance). The anti-virus program will still check
attachments as you
>open them, because Outlook saves a copy of the file to
your hard drive and
>then opens that copy, which the virus scanner will check
first.
>
>Bottom line is that I think Outlook 2002 with SP3 but
without anti-virus
>email scanning is more secure than OL2002 without SP3
and with anti-virus
>email scanning.
>
>Various vendors are working on updates. They have every
reason to be upset
>with Microsoft over this release, if they did not
receive any advance
>warning.
>
>I agree, too, that Microsoft could have done a much
better job of laying the
>groundwork for this release with the end user. Certainly
the KB article for
>SP3 should have included information on these security
changes on Day 1, not
>toward the end of Day 3.
>
>--
>Sue Mosher, Outlook MVP
>Author of
> Microsoft Outlook Programming - Jumpstart for
> Administrators, Power Users, and Developers
> http://www.outlookcode.com/jumpstart.aspx
>
>
>"Pat" <pkeller8@comcast.net> wrote in message
>news:c5c401c40904$6c067c20$a401280a@phx.gbl...
>> By POOR design. There is no reason why MS could not
>> identify the program accessing and allow the user to
>> create an 'exception' list of some kind for known
>> companion products. Worse yet... the web site for
>> regarding SP3 says:
>>
>> >> To remove this download:
>> >> There is no uninstall feature for this download.
>>
>> Meaning I have absolutely no option but to completely
>> uninstall and reinstall withOUT SP3 if I want to
continue
>> functioning until my vendor provides an update.
>>
>> There were several possible options for MS to HELP
>> customers and 3rd party vendors get around this problem
>> with just a little flexibility. They chose not
implement
>> any of them. I am forced to either stop using Outlook
>> altogether, run without my desired companion product or
>> run with less than optimum security. I am NOT an MS-
>> basher - but honestly believe that the leading software
>> manufacturer in the world could have and should have
done
>> better.
>>
>>
>>
>>
>> >-----Original Message-----
>> >It's not a bug. It's by design.
>> >You may be able to get around the problem by either
>> disabling Word as
>> >your e-mail editor or updating some of your add-ins,
>> especially virus
>> >scanners. See the following article for more
>> information:
>> >
>>
>http://www.slipstick.com/outlook/ol2002sp3.htm#problems
>> >
>> >--
>> >Russ Valentine
>> >[MVP-Outlook]
>> >"Emil Tonnesen" <emilst@mobilpost.com> wrote in
message
>> >news:USC4c.342$zf6.5276@news4.e.nsc.no...
>> >> After installing SP3 i get the message "A program is
>> trying to accsess
>> >> e-mailadresses you have stored in Outlook".
>> >>
>> >> Here is a copy of the errormessage:
>> >> http://westie.no/emil/images/Skjermdumpbilde001.jpg
>> >>
>> >> When is Microsoft planning a fix for this bug?
>> >> What to do now?
>> >>
>> >> Installed compontents;
>> >> Win XP Pro
>> >> Norton Internet Security 2004 (incl. NAV2004).
>> >>
>> >>
>> >
>> >
>> >.
>> >
>
>
>.
>

Relevant Pages

  • [NT] MHTML vulnerability in Outlook Express
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability in Outlook Express allows an attacker to run code of the ... If an attacker were to host a malicious website that contained an MHTML ...
    (Securiteam)
  • Bypassing SMTP Content Protection with a Flick of a Button
    ... How about using Outlook Express as ... more than an Outlook Express client and employs a rarely-used feature ... This RFC documented feature called "Message Fragmentation and ... comprehensive security policy to restrict potentially harmful content ...
    (Bugtraq)
  • [VulnWatch] Bypassing SMTP Content Protection with a Flick of a Button
    ... How about using Outlook Express as ... more than an Outlook Express client and employs a rarely-used feature ... This RFC documented feature called "Message Fragmentation and ... comprehensive security policy to restrict potentially harmful content ...
    (VulnWatch)
  • Re: How do I receive an access database?
    ... To provide enhanced security, Microsoft Office Outlook 2003 is designed to ... If you need to share files that have file types blocked by this feature, ... There is no control over those files (no settings within ...
    (microsoft.public.access.gettingstarted)
  • Re: Unsafe Attachments
    ... Teach Yourself Outlook 2003 in 24 Hours ... > Outlook 2002 includes a new security feature that blocks> attachments considered unsafe. ... > Request that the sender use a file compression utility> that changes the file extension. ...
    (microsoft.public.outlook.installation)