There's so many of these MS issues -- over 50 this year alone -- that there's no point in posting a new thread on each one.
So I'm just adding them here, for anyone interested:
To prove that no security bug is truly harmless, a security group has stitched together two minor flaws in Microsoft's Internet Explorer 6.0 browser with a small glitch in Windows Media Player to create one seriously powerful attack.
By coaxing IE users to view a Web page containing the special code, an attacker can silently force Windows 98, Windows 2000, or Windows XP users to run a malicious program of the attacker's choice.
Using a rarely used feature called 'message fragmentation and re-assembly' (MFR), an attacker can send emails that will "bypass most SMTP filtering engines", Beyond Security reports.
This MFR feature, which allows Internet users to split up sent messages, helping surfers with slow connections to send smaller segments of a larger email in multiple emails, is supported by Internet standards (RFC 2046) but easily enabled on only one client - Outlook Express.
On Outlook Express the re-assembly feature is enabled by default, while the fragmentation feature can be enabled from a drop down menu.
This is a horribly nasty and childishly easy exploit and Microsoft can't patch it a moment too soon. The fact that the feature exists at all is ample illustration that Microsoft places usability (users don't want to click on dialogue boxes) over security.
Microsoft Word flaw may allow file theft
I find it very interesting that Microsoft is only going to fix Office 2000 and Office XP.
The millions of users still using Office 97 are screwed. The only fix for those people is to send a check to Redmond.
Let's see:
"Yo. You gotta problem. Either you pay us or your business might be broken into and your stuff stolen.
is different from:
"Security Problem! Either you pay us or your business might be broken into and your stuff stolen."
how?
I love the tech industry. Where else can you commit extortion right out in the open and people will fall all over themselves to point out that it's all the victim's fault?