From: "Glenn Meadows" 

This is a multi-part message in MIME format.

------=_NextPart_000_0046_01C486A4.E948D700
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Yea, I noticed/realized that, but you know users, can't live with them, =
can't live with them.....Eventually, someone might write an exploit that =
uses this on a single click of the image...those people that try to do =
this stuff are very inventive in ways to get users to do stupid stuff, =
for sure.

--=20
Glenn M.


  "Rich"  wrote in message news:41261593$1{at}w3.nls.net...
     This requires the user to explicitly drag and drop a broken image =
to somewhere.  Once you start with scenarios which require the user to = do
stuff like this you can imagine all sorts of things.  That the image = is
broken makes it worse.

  Rich

    "Glenn Meadows"  wrote in message =
news:41260c9c{at}w3.nls.net...
    May not be new, but just discovered/posted.

    http://www.theregister.co.uk/2004/08/20/sp2_scripting_vuln/

    --=20
    Glenn M.



------=_NextPart_000_0046_01C486A4.E948D700
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable








Yea, I noticed/realized that, but you know users, can't live with =
them,=20
can't live with them.....Eventually, someone might write an exploit that = uses=20
this on a single click of the image...those people that try to do this = stuff are=20
very inventive in ways to get users to do stupid stuff, for sure.
-- Glenn M.
 
 

  "Rich" <{at}> wrote in message news:41261593$1{at}w3.nls.net...
     This
requires the user =
to explicitly=20
  drag and drop a broken image to somewhere.  Once you start with =
scenarios=20
  which require the user to do stuff like this you can imagine all sorts =
of=20
  things.  That the image is broken makes it worse.
   
  Rich
   
  
    "Glenn Meadows" <gmeadow{at}comcast.net>">mailto:gmeadow{at}comcast.net">gmeadow{at}comcast.net>
=
wrote in=20
    message news:41260c9c{at}w3.nls.net...Ma=
y not=20
    be new, but just discovered/posted.http=">http://www.theregister.co.uk/2004/08/20/sp2_scripting_vuln/">http=
://www.theregister.co.uk/2004/08/20/sp2_scripting_vuln/--=20
    Glenn
M.

------=_NextPart_000_0046_01C486A4.E948D700--

--- BBBS/NT v4.01 Flag-5