Re: [Evolution] [Fwd: Another possible RFC 2046 vulnerability.]

On Fri, 2002-09-27 at 11:48, Richard Bellavance wrote:
I hope support for this aberration will not be integrated into

It's not an aberration, and it's not a security hole. The only reason
why some people consider this a security problem is because they were
trying to pretend that you can make insecure email clients secure by
just filtering what gets to them. Surprise! You can't!

At least, 1.0.8 does not seem to support it.

Evo actually did used to support message/external-body. (The code
bitrotted when the attachment display code changed somewhere around
0.9.) It displayed the attachment as a link you could click on if you
wanted to fetch the body. And so if someone sent you a message with an
external-body pointing to a trojan horse program, then when you click on
it... it would ask you what directory you wanted to save the file in.
Exactly the same as if it arrived in an attachment. No security problem

-- Dan

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]