CVE-2016-3366

Microsoft Outlook 2007 SP3, Outlook 2010 SP2, Outlook 2013 SP1, Outlook 2013 RT SP1, Outlook 2016, and Outlook 2016 for Mac do not properly implement RFC 2046, which allows remote attackers to bypass virus or spam detection via crafted MIME data in an e-mail attachment, aka "Microsoft Office...

CVE-2016-3366

The CVE-2016-3366 issue is a spoofing vulnerability in Microsoft Outlook where MIME attachments are not correctly terminated per RFC 2046, allowing crafted attachments to bypass antivirus/antispam scans. Affected products include Outlook 2007 SP3, 2010 SP2, 2013 SP1 (and RT1), 2016, and Outlook 2...

Sending multipart/form-data requests from Flash (with arbitrary headers)

Hello lists, In my original "Forging HTTP request headers with Flash" paper http://www.securityfocus.com/archive/1/441014, I mentioned forcing multipart/form-data input format to ensure that Flash's LoadVars isn't used to forge the request. However, there's a work-around for the attacker - using...