Re: {\rtf\a112911112911112911112911...112911} in the body will cr ash OE5 clients.

["Dawes, Rogan (ZA - JNB)" <rdawes@DELOITTE.CO.ZA>]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

And having it in the subject causes funnies with the full outlook 2000
client as well.

I was scrolling through the bugtraq messages, and noted that this
message(call it #2) had the same subject that the previous message(#1) did,
although the window title had been updated appropriately. Moving on to the
next message (#3), and going back again left me with the subject from
message #3 showing on the subject line.

It may be possible to overflow Outlook itself by including a carefully
crafted subject line.

Outlook version 9.0.0.2711 on NT 4 SP5

Rogan

> -----Original Message-----
> From: Indeera [mailto:indeera_@HOTMAIL.COM]
> Sent: Wednesday, February 23, 2000 11:49 PM
> To: BUGTRAQ@SECURITYFOCUS.COM
> Subject: {\rtf\a112911112911112911112911...112911} in the body will
> crash OE5 clients.
>
>
> This was tested by sending a message having the above string
> in the body
> from hotmail to OE5 client version 5.50.3825.400 on NT4
> server  sp6. first
> experianced while trying to open the message sent by Pauli
> Ojanpera subject
> reading 'riched32.dll buffer overflow'. Might not work in other OE5
> versions.  Just thought some one might be interested in this.
> cheers
> ind
> ______________________________________________________
> Get Your Private, Free Email at http://www.hotmail.com
>