HTML mail follow-up
HTML mail follow-up
- Subject: HTML mail follow-up
- From: "John S. Baltutis" <email@hidden>
- Date: Fri, 09 Feb 2001 15:23:05 -0800
Another reason to discourage using HTML in e-mails?
From MacInTouch (2/09/01) Anders Pearson and Peter Leonard of the
Columbia Center for New Media Teaching and Learning have discovered
an Internet Explorer vulnerability to Web-mail spoofing attacks,
present in Version 5.0 of IE on the Mac (Version 4.0 on Windows):
[Kee Hinckley (from Bugtraq)] "Hotmail at least, and most likely all
other web-based mail systems, does not filter out HTML hidden in
images (one can hardly blame them). As a result, the JavaScript and
CSS spoofing attacks previously described on this list can be used
against a Macintosh Hotmail user, and Hotmail will *not* filter out
offending HTML, JavaScript or CSS tags. This technique may also work
against some virus scanners."