RE: [Full-Disclosure] Anyone? Important Security Update for the .NET Messenger Service

["Drew Copley" <dcopley@eeye.com>]

Yeah, it's real, but it also highlights that they are not paying
attention. Notice how nowhere in this page is there a mention of what
this security issue is. This is typical with MSN updates. There will
probably be an advisory released with technical info. Or will there not
be? 

I have found several issues in 4.7 client. Problem is you would have to
hijack a server to use them because the server between the clients
strongly prohibits overly long strings. Further, their latest version
has fixed these issues for some months now. So what is new? It sounds
like there is something new and nasty with the whole Passport system
through MSN... But, they do not say. 




> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com 
> [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of 
> Chris DeVoney
> Sent: Tuesday, August 19, 2003 12:49 PM
> To: full-disclosure@lists.netsys.com
> Subject: RE: [Full-Disclosure] Anyone? Important Security 
> Update for the .NET Messenger Service
> 
> 
> > Anyway, I'm pretty sure it's some kind of spam or whatever. But it 
> > seemed so valid, it makes you wonder about it...
> 
> >From another list answering the identical question, Mary Jo 
> Foley who 
> >write
> the Ziff-Davis Microsoft Watch newsletter:
> 
> It's real, but Microsoft is unfortunately spamming
>  folks with the message.
> 
> Here's the real update page: 
> http://messenger.msn.com/Help/Upgrades.aspx
> 
> And more info. 
> available here: http://www.msnfanatic.com/
> 
> And here: http://www.theinquirer.net/?article=11110
> 
> MJF
> 
> cdv
> 
> ------------------------
> Chris DeVoney
> Clinical Research Center Informatics
> University of Washington
> ------------------------
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html