Re: [Full-disclosure] Recall: Oracle read-only user can insert/update/delete data

2006-04-13 Thread Michael Holstein

In my experience, it doesn't even work in an Exchange environment. The
user gets a message that the message should be recalled, but the
original is still there, even if it hasn't been read yet. I've heard
people say that at one time it would auto-delete the message if it
hadn't been read, but I've never seen that.


It does, provided you read the recall message first -- but since 
Outlook (by default) displays in reverse chronological order, and most 
people read email in the order received, it does little good.


Back when I was involved in Exchange administration, I can't tell you 
how many times I had to stop services and run exmerge against the store 
to clean out messages that somebody accidently sent to a distribution list.


That .. and all the people that got embarassed due to incorrect use of 
reply-all ;)


~Mike.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Re: [Full-disclosure] Recall: Oracle read-only user can insert/update/delete data

2006-04-13 Thread Brian Eaton
On 4/13/06, Michael Holstein [EMAIL PROTECTED] wrote:
  In my experience, it doesn't even work in an Exchange environment. The
  user gets a message that the message should be recalled, but the
  original is still there, even if it hasn't been read yet. I've heard
  people say that at one time it would auto-delete the message if it
  hadn't been read, but I've never seen that.

 It does, provided you read the recall message first -- but since
 Outlook (by default) displays in reverse chronological order, and most
 people read email in the order received, it does little good.

Anybody understand how MS Exchange implements the recall
functionality?  I could see nothing in the e-mail headers that
appeared to prove the sender of the original message was the sender of
the recall request.

- Brian

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Re: [Full-disclosure] Recall: Oracle read-only user can insert/update/delete data

2006-04-13 Thread Micheal Espinola Jr
On 4/12/06, Mike Owen [EMAIL PROTECTED] wrote:
In my experience, it doesn't even work in an Exchange environment. Theuser gets a message that the message should be recalled, but the
original is still there, even if it hasn't been read yet. I've heardpeople say that at one time it would auto-delete the message if ithadn't been read, but I've never seen that.Secunia - 
http://secunia.com/
For the most part:

It only works within an Exchange environment.
It only works with unread messages.
It only works if the unread message is located in the Inbox.

More info:

http://office.microsoft.com/en-us/assistance/HA010917601033.aspx-- ME2 
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Recall: Oracle read-only user can insert/update/delete data

2006-04-12 Thread Bill Weiss
Van Winssen, Andre A SITI-ITIBHW5([EMAIL PROTECTED])@Wed, Apr 12, 2006 at 
07:56:08AM +0200:
 The sender would like to recall the message, Oracle read-only user can 
 insert/update/delete data.

Hey, everybody!  It's that guy who uses Exchange and doesn't know that it
doesn't work with the outside world!  Why don't we all laugh at him?

(With apologies to The Simpsons fans everywhere)

-- 
Bill Weiss

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


Re: [Full-disclosure] Recall: Oracle read-only user can insert/update/delete data

2006-04-12 Thread Mike Owen
On 4/11/06, Bill Weiss [EMAIL PROTECTED] wrote:
 Van Winssen, Andre A SITI-ITIBHW5([EMAIL PROTECTED])@Wed, Apr 12, 2006 at 
 07:56:08AM +0200:
  The sender would like to recall the message, Oracle read-only user can 
  insert/update/delete data.

 Hey, everybody!  It's that guy who uses Exchange and doesn't know that it
 doesn't work with the outside world!  Why don't we all laugh at him?

 (With apologies to The Simpsons fans everywhere)

 --
 Bill Weiss


In my experience, it doesn't even work in an Exchange environment. The
user gets a message that the message should be recalled, but the
original is still there, even if it hasn't been read yet. I've heard
people say that at one time it would auto-delete the message if it
hadn't been read, but I've never seen that.

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


[Full-disclosure] Recall: Oracle read-only user can insert/update/delete data

2006-04-11 Thread Van Winssen, Andre A SITI-ITIBHW5
Title: Recall: Oracle read-only user can insert/update/delete data






The sender would like to recall the message, Oracle read-only user can insert/update/delete data.



___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/