They've yet to deliver a security zone bug that works from the Restricted Sites Zone. That's because Restricted Sites blocks practically ALL active content (scripts, ActiveX, Java, frames, file downloads, ...).

As such, OE 6.0 SP1 / Outlook when properly updated will *NEVER* be vulnerable to using frames as a snooping technique. I was simply pointing out that the technique stated in the article fails on a default version of a widely-used product.

So, before claiming apocalypse-like problems with e-mail privacy, it should be realized that this is not the case. Oddly enough, Microsoft actually seems to be out ahead of an issue, rather than behind the curve... its usual position.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/258/27883#27883